Compiler architecture
September 20, 2026 · View on GitHub
Status: living internal implementation and trust-boundary map.
Audience: compiler contributors and reviewers.
This document owns the current implementation map, data flow, and trust boundaries. It does not own product status, protocol details, historical changes, or test inventories:
- current status: completion matrix;
- exact protocols and ABIs: their versioned reference documents;
- required checks: quality gates;
- history: changelog.
SEMAPRAX v0.4 is a set of bounded vertical slices through a larger language design (v0.2 remains the first archived tag milestone). The architecture keeps human source, verified meaning, agent projections, mutation authority, and target execution distinct.
src/workflow_profile.rs and its enabled submodule own the optional
current-thread workflow observer. Instrumentation
is absent without its Cargo feature; observations never enter canonical
products or acquire authority. benches/workflow_observer.rs and the performance
campaign runner own measurement, exact product comparisons, and host metadata.
System shape
canonical .spx source or held Project inputs
|
lexer + parser
|
AST
|
resolver + semantic verifier
|
validated stable-ID HIR
|
canonical cleanup-plan builder
|
independent plan replay
/ | \
semantic graph interpreter target lowering
| / \
context/impact/review native C11 Wasm Core
| | |
evidence + transactions Clang JS/Node host
No backend bypasses source verification or validated-HIR checks. Cleanup-plan vectors are canonical execution order and must not be sorted or repaired by a graph projection or backend.
The additive agent_lifecycle/iterative module owns checked Step transitions,
per-turn authorization, bounded stage execution, and iterative evidence. Its
step validator maps checked variant fields back to exact State/Result records;
the frozen one-pass lifecycle retains its existing owner. The iterative/effects
module binds scalar operation registries to deployed contracts, meters calls and
encoded argument/result bytes, and validates host results before reduction.
agent_runtime_v2 exposes the direct consuming producer implemented by
execution_revision/typed; it owns exact invocation inputs and joins evidence
only from the run it actually executes. The private iterative/driver reserves
stages and exposes the effect and transition boundaries to
iterative/effects/durable, which owns the trusted-store execution adapter.
agent_runtime_v2/checkpoint owns only the closed journal codec and accounting;
its hashes confer no authority. The durable producer replays checked stages and
fresh authorizations before accepting retained host observations, charges replay
fuel, and stops on uncertain delivery. execution_revision
joins retained Project source, ProgramRoot, deployment, invocation and actual
lifecycle evidence through opaque consuming producers. These associations grant
no host authority. The generic collection helper under hir/generic_collection
owns exact private Box/Vec signature admission; source verification and HIR
materialization independently validate concrete substitutions.
Private generic collection and iterator-helper admission lives in
src/source_verify/declared_type/generic_collection.rs and the independent
src/hir/generic_collection.rs profile. Existing monomorphization and HIR
validation check all eight concrete Copy substitutions; Box/Vec interpreters
and backends consume the same canonical cleanup plans and runtime carriers.
The owning specification defines the exact
private signature boundary.
The generic iterator profile reuses those source/HIR
classifiers for scoped Iter<T> and IterStep<T>, with exact Step field
identities and independent match-binding ownership validation.
Authored generic variant admission is owned by the independent
source_verify/declared_type/generic_variant and hir/generic_variant profiles.
The HIR validator checks all concrete substitutions and match bindings.
cleanup_plan/build/generic_variant produces the canonical arm-result and
continuation transfers; native and Wasm helpers consume those transfers in
order. Private workspace signature admission checks retained declaration facts
in both workspace collection and HIR linking. Public signatures retain their
separate admission boundary.
Representations
The registry compiler and unpublished full toolchain share one compiler library
and src/cli_driver.rs. The root retains dispatch;
src/cli_driver/options.rs owns command-specific bounded option parsing,
src/cli_driver/report_options.rs owns report and analysis option parsing, and
src/cli_driver/source_execution.rs owns single-file build, run, and diagnostic
publication.
The standalone binary supplies no private-host hooks.
The private source_live_cli host supplies the versioned durable source CLI,
held-directory checkpoint store and restart-stable clock. It derives bindings
from retained Projects and explicit task/read snapshots, then uses the existing
source journal and migration driver. A predecessor-held claim restricts CLI
migration to one destination; neither journal hashes nor that claim authenticate
a store replaced or rolled back by its owner.
crates/semaprax-toolchain owns the doctor implementation and the held-parent
staged publication behind its new; the compiler library owns the bounded
standalone new route (src/project/create.rs), and both share one grammar and
one scaffold. The toolchain also owns the
Project Native Rust package publication adapter, and safe Windows revision-store
host. Its opencode_host module owns the explicit fixed-provider process,
nonblocking output bounds and transport receipt binding. Its source adapter
implements the existing lifecycle ProposalSource; compiler-owned run_live
retains canonical proposal admission and checked deterministic stages. The
core exposes only the existing read-only retained-value encoding for context.
live_invocation/priced wraps the generic kernel with paired work and money
reservations. live_invocation/persistence/priced commits both in one additive
checkpoint envelope; recovery preserves unknown charges and never authorizes
redispatch. live_invocation/io and persistence/priced_io own the opt-in v2
outer envelope's exact logical request bytes, maximum response reservations,
and successor I/O carry. Monetary and I/O handoffs share one predecessor
identity, generation, and chain. Existing generic journal bytes remain unchanged.
The source-specific checkpoint grammar lives under
src/live_invocation/source_journal; it uses the existing caller-owned
CheckpointStore and keeps the generic journal wire unchanged. Its validated
recovery data supplies the existing cumulative ledger's source restoration
route. The v2 execution profile additionally owns full stage-fuel reservations,
charged replay reservations, optional usage observations, and terminal snapshots.
source_journal/io_v5 owns additive cumulative request/response reservations
and their nonrefundable migration carry; Source Live I/O v5
defines the bound limits and the private CLI v3 projection.
source_journal/policy_v6 owns independently folded quote reservations, observed
and unknown exposure, and cumulative policy carry. Its V6 profile composes I/O
limits and restores reservations before source continuation.
provider_adapter_sdk/source_bridge/policy owns ordinary adapter quote admission
and observed overage accounting; the journal remains the durable authority.
provider_adapter_sdk/bridge implements the generic ModelHandler seam over
explicit adapter capabilities. It streams deltas through the existing compiled
Proposal decoder before the kernel's independent compiled-schema decode and
authorization. model_budget_policy/live_hook composes explicit request-bound
host token/cost estimates with the existing work hook, retaining conservative
charges in memory without claiming generic-journal crash recovery.
model_budget_policy/retry owns bounded in-process adapter attempt scheduling
and the reservation trail. It consumes an explicit provider factory and host
backoff/classification seams; it adds no durable journal or deployment authority.
model_budget_policy/durable derives retained execution and deployment limits.
live_invocation/policy_kernel and policy_kernel_v3 compose that scheduler
with caller-owned checkpoints; the V3 journal binds exact SDK envelope-byte
reservations beside frozen V2 policy bytes. Journal recovery validates all
retained associations before the scheduler can construct an adapter.
provider_adapter_sdk/vendor owns Responses and Messages wire normalization
behind the explicit HostHttpStreamTransport seam. The host retains origin,
TLS, proxy and credential configuration; compiler-derived Proposal admission
remains in the streaming/schema owners.
provider_adapter_sdk/vendor/http implements the native HTTPS seam with
explicit origin, TLS and credential configuration, disabled redirects/proxies,
and bounded buffered responses. It does not provide incremental network polling.
authentication owns explicit Rust-host secrets, bounded Argon2id password
hashing, authenticated session transitions and account/session composition.
Storage, entropy, clock and signing authority remain supplied by the embedding
host; no source operation or generated backend authority is added. See
Authentication host v1.
job_runtime owns single-job checkpoint persistence and host-driven execution;
job_fixture owns lifecycle decisions and job_evidence owns replay validation.
Payload admission uses a supplied compiled schema; handler implementation and
checkpoint storage authority remain explicit host responsibilities.
job_runtime/source_handler binds a retained, effect-free source callable to
a domain-separated deployment identity stored in the existing job descriptor.
Its checked drive verifies descriptor and schema before the existing runtime
claims work; evaluation uses the retained-call interpreter without adding host
authority. Imported callable closures remain outside this bounded source route.
provider_adapter_sdk/source_bridge adapts the ordinary source ProposalSource
with explicit fresh adapter factories, bounded canonical retained context, and
streaming_proposal_decode/source admission against the authoritative source
Proposal schema. streaming_proposal_decode/grammar consumes a bounded
DAG lowered by both schema owners, enforcing nested identity/order/scalar
rules while retaining final whole-decoder admission. Sorted auxiliary case
lookups narrow candidates per byte without changing declaration order.
AgentRuntimeV2::run_live consumes that ordinary source
through Direct Runtime v2 only after canonical proposal admission and at the
typed-effect boundary; submitted proposal inventories are refused on this live
route. The separate run_live_bound_model_durable entry in
execution_revision/typed_durable reuses Source Live Journal v2. It binds the
typed registry and effect ceilings into the program-root commitment, ACKs model
intent before adapter dispatch, and restores typed effect accounting from exact
acknowledged observations without redispatch. The source adapter retains raw
settlement bytes for that journal; canonical decoded proposals alone enter
source authorization. It adds no provider transport or ambient authority.
agent_lifecycle/iterative/model owns the separate bounded local target-parity
model boundary. It projects the lifecycle-owned Proposal request into one
canonical authority-free request, consumes a private per-turn grant, reserves
model call/byte/fuel accounting before an injected host, and emits independently
replayable canonical evidence. The combined test seam runs the surrounding
checked stages and target effects on interpreter, native C11 and Core Wasm; it
does not make the Direct Runtime provider adapter a target ABI or add provider,
network, checkpoint, or production-backend authority.
compact_semantic_projection/selected wraps existing task, public API, candidate,
and Agent graph producers and independently regenerates selected content on
replay; encoded evidence cannot replace the owning compiler object.
semantic_service_transport/compact selects from exact retained service
snapshots and feeds the same codec; MCP forwards to that dispatcher.
cli/compact owns explicit host input/replay paths and writes only stdout.
compact_semantic_projection/model_text owns additive model-text v2 with
selective dictionaries and bounded expansion. It normalizes independently
decoded bytes through the existing projection encoder, preserving v1 wire
semantics and producer authority.
embedding_api/analysis_request owns source/label/symbol preflight and bounded
refusal echoes for stateless operations, with shared hard caps for execution.
embedding_api/project_session exposes caller-owned source admission and the
existing semantic service through opaque handles and canonical reports. It
retains the service's staged refresh and replay boundaries; caught stateful
panics poison the facade rather than presenting its state as reusable.
model_call_receipt/invoice_import bounds raw invoice input before explicit
adapter verification, retains canonical imports and reconciliation evidence,
and gives neither record dispatch authority. audit_view/canonical owns the
exact audit wire projection; verification requires complete disclosure coverage
and independently retained payload association.
model_call_receipt/emission provides checked receipt methods on actual live
run/checkpoint objects while keeping required host facts explicit.
model_call_receipt/receipt_decode owns the bounded canonical v1 inverse.
model_call_receipt/generic_enrichment reconstructs rich host-bound receipts
from validated journals and independently compiled decode outcomes; observed
adapter joins retain separate logical and transport byte counts.
model_call_receipt/source_enrichment binds recovered source attempts to
independent host facts and canonical observation/prompt preimages. Recovery
retains the already-committed optional ProgramRoot for read-only comparison;
identity and journal wire formats remain unchanged.
model_call_receipt/observed_usage projects only declared provider accounting
into the existing reconciliation vocabulary, preserving missing dimensions.
model_call_receipt/journal_projection validates generic journal inputs and
folds per-attempt evidence; model_call_receipt/source_projection folds opaque
recovered source checkpoints. Both bind the complete journal chain, preserve
unknown host facts, and export read-only Audit Capsule object references.
Neither projector writes journal rows or grants replay/dispatch authority.
provider_adapter_sdk/observation decorates actual adapters with bounded,
commitment-only ordered attempt capture. model_call_receipt/adapter_projection
joins settled captures to independently validated generic journals and compiled
schemas using the live bridge's shared request projection.
Model Call Adapter Evidence v1 owns that
additive evidence and its zero-dispatch replay.
Model Call Journal Receipt v1 owns this
additive schema separately from the enriched host-metadata receipt contract.
agent_runtime_v2/source_model owns the additive source-model binding and
redacted attempt observations. The bound streaming adapter checks deployment
selection and compiler schema before dispatch; execution_revision/typed
joins that exact binding, attempt digest and closed outcome into EvidenceRoot
v4. Its opt-in policy path reuses model_budget_policy admission before
adapter construction and commits nonrefundable reservations. The compatibility
live route retains v3 roots. This addition is nondurable;
Source Model Operation v1 owns its scope.
agent_lifecycle/iterative/source_live owns the one ledger and replay cursor;
its optional session hooks reuse the checked loop in iterative/driver/live
for fresh and recovered execution. Replayed stages reserve fresh fuel before
evaluation, while acknowledged model/effect results replay without physical
redispatch. Unresolved intents fail closed. Recovered terminal bytes are an
opaque receipt, never a newly checked carrier or continuation authority.
source_live/migration selects both retained Project role closures, rechecks
the predecessor's actual Suspend State against its flat schema, and reuses the
checked pure migrator from execution_revision/typed_migration.
source_journal/migration owns the additive v3 handoff identity and charged
pure-evaluation prefix in the same source journal. After an acknowledged,
schema-checked migration settlement, the checked live driver starts at Observe
on the migrated State; it skips Initialize and carries the predecessor's
model, stage, effect, turn, fuel, clock and deadline commitments forward.
Uncertain model/effect intents still forbid redispatch. Store freshness and
exclusive writer ownership remain caller obligations across both checkpoints.
The private adapter's source_checkpoint module records explicit model attempts
through that sink. Its durable_source wrapper borrows the driver's ledger for
one attempt, acknowledges intent before transport and settlement before exposing
response text, and records optional usage in the same journal. The private source_live_cli
host composes that adapter with an explicit filesystem checkpoint store for
run, resume and checked migration. An in-memory receipt is not a checkpoint.
Pre-dispatch host cancellation returns a Cancelled source-live failure with
no attempt intent or provider dispatch. Adapter-local cancellation, deadline
or budget classification without a receipt is accepted only when the journal
is untouched and healthy. A changed journal or claimed dispatch without its
receipt remains ModelFailed; an unresolved intent cannot become a clean stop.
No private crate is a normal or optional dependency of the registry
package. Compiler-owned SDK replay and Windows carrier preparation/replay remain
before/around explicit injected host calls; opaque prepared facts are not
filesystem authority. See development for binary selection.
For Windows Project v8–v10 npm/Web publication, the compiler's opaque
ProjectNpmPublication retains preparation and replay under the live snapshot.
The private toolchain's owned_npm module alone performs held-handle six-file
publication; the CLI dispatches before legacy output-parent creation. Standalone
publication rejects safely. Cleanup authority ends before settlement/rename;
post-publication byte, inventory and path rechecks cannot regain rollback.
See Windows owned npm publication for
admission restrictions and the explicitly scoped physical gates.
The full toolchain's calculator, library, and service generators check exact
owned template bytes before staging through NewProjectAuthority in the lower
package crate. The template choice fixes either the three-file calculator/
service src inventory (identical file names, distinct contents) or the
three-file library src inventory before namespace creation.
Staging selection excludes exact/ASCII-case-equivalent destination names before
creation; the lower authority independently rejects the same collision.
Publication latches before final held-byte and destination-path authentication;
the CLI additionally rechecks the original requested parent spelling. Failure
after that latch cannot regain cleanup authority. See Calculator project
publication v1 for the correction and maintained regression gates.
src/project/scaffold.rs separately derives and independently replays the same
five calculator files, including the in-project AGENTS.md guide, as a bounded
semaprax.project-scaffold.v2 artifact.
The standalone CLI prints those canonical bytes directly to stdout. The
artifact owns no path, file handle, staging namespace, process, or publication
authority; materialization remains entirely caller-owned. See Public Project
Scaffold Capsule v2.
src/doctor.rs (with src/doctor/offline_profile.rs and
src/doctor/version_token.rs) is the doctor policy module shared by both
binaries: it owns strict bounded --profile selection and one scoped
offline-profile admission per report, and it spawns nothing. The toolchain's
settled_report.rs renders a provisioner-owned settled observation through
the same policy and is the only doctor code that names the private platform
crate. Missing/unavailable profiles fail
required checks without ambient discovery or tool execution; returned selector
and platform facts are checked before tool callbacks. No production admission
backend is implemented, so the real CLI currently reports unavailable rather
than invoking installed tools. Reports describe selected tools, not ambient
build readiness. No root unsafe code or dependency is added.
The separate safe DoctorOfflineInput facade delegates only borrowed-file
sealed-memory acquisition to the existing sys quarantine. Native64 Linux checks
seals before metadata or positional reads and never duplicates/closes the
caller's descriptor. It returns bounded immutable untrusted bytes, not profile
or execution authority; unsupported hosts reject. This input primitive is not
connected to the CLI. See Doctor sealed input v1.
The adjacent offline_input/create component creates only anonymous
non-executable sealed transport files from explicit bytes, then reuses that
acquisition path before transferring the file and snapshot together. Its Linux
adapter owns bounded writes, seal/property checks and one-shot failure cleanup;
the safe facade only delegates. It performs no path discovery or worker launch.
The explicit executable-image factory shares this ownership/write/acquisition
engine under a private fixed storage policy, with native ELF preflight, checked
owner-only execute mode and mandatory executable sealing. It creates storage,
not an approved image or profile admission; the ordinary input route stays
non-executable and the launcher independently validates its inherited files.
The sys quarantine's unsafe-free DoctorOfflineBundle parser consumes that
snapshot into a closed selector/architecture-bound inventory with zero-copy file
views, bounded paths/roles and minimum ELF/interpreter checks. The safe facade
delegates to this single validator; no public constructor bypasses admission.
It owns no OS effects and does not establish full ELF validity, library closure
or execution authority. See Doctor offline bundle v1.
Its encode module prepares canonical bytes from explicit borrowed entries and
role indices, with size preflight and replay through that same full validator.
The request module derives exact worker-request binding from the retained
opaque bundle. Both preparation routes are unsafe-free and return only bytes;
they do not mint sealed-input or settled-observation authority or discover files.
The separate private doctor/offline_root component preallocates a bounded plan
from that opaque bundle and materializes a detached read-only tmpfs inside an
already controlled child context. It owns only newly created descriptors and
does not perform namespace bootstrap, inherited-handle cleanup, root entry or
tool execution. The general-host launch route remains deliberately unwired;
inherited descriptor closure can itself dispatch foreign filesystem flushes.
See Doctor offline root materialization v1.
The private doctor/offline_worker component connects sealed request/bundle
validation (wire.rs) to fresh pidfd-owned PID namespaces and bounded capture
(capture.rs), controlled root/capability preparation (child.rs) and a
default-deny syscall policy (guard.rs). The separately invoked
semaprax-doctor-worker binary lives in the existing sys quarantine and invokes
only its unsafe dedicated-process entry; no safe embedding facade exposes that
operation. It requires an externally provisioned clean process,
private user/mount namespaces and aggregate resource/lifecycle ownership.
There is no ambient worker discovery, installer or CLI activation. Its reply
binds observations to request bytes, not executable provenance or admitted
version policy. Linux execution and hostile fixtures are included in the v0.4.0 hosted-green regression corpus;
macOS/Windows require separate native implementations. See
Provisioned offline doctor worker v1.
Capture's private native-operations adapter owns OS effects, while native and
scripted test operations share the observation/settlement control flow. Test
scripts cannot create process authority. External lifecycle fixtures inspect a
stopped supervisor's pinned child; they do not expose procfs to the tool or
change the production syscall filter.
The separate doctor/offline_collector sys component consumes a provisioner-owned
live worker handoff. It alone constructs opaque settled observations after exact
pidfd exit/reap, bounded capture, request/bundle/reply binding and owned-handle
closure. The safe facade reexports only immutable observation types. A small
unpublished semaprax-doctor-collector entry crate bridges that unsafe process
boundary to the toolchain library's shared doctor report policy, avoiding a
dependency cycle or an unsafe ordinary CLI. Tool rows stay keyed by role even
when their bundled paths alias. This provisioned entry does not activate ordinary
CLI worker discovery. See Provisioned offline doctor collector v1.
The adjacent doctor/offline_launcher component owns seal-first preflight of
both inputs and approved executable images, high descriptor preparation,
exclusive worker-pipe construction, pidfd-owned cloning and collector exec.
It shares the existing minimum ELF validator and never reopens image paths.
Its separate private binary consumes an already provisioned process, preserving
parenthood while transferring the collector's fixed inventory; it neither
bootstraps namespaces nor authenticates image/loader provenance. See
Provisioned offline doctor launcher v1.
The outer doctor/offline_provisioner sys component now supplies the first
bounded Linux bootstrap around that launcher. Its dedicated private binary
admits one signed release capsule and exact sealed request/bundle/static-image
inventory, creates private user/mount/network/IPC/UTS namespaces, places the
child atomically into one authenticated delegated cgroup-v2 scope, and retains
pidfd plus cgroup authority until reap and populated 0. The worker selects one
closed default-deny syscall table per authenticated tool role. This boundary
does not activate ordinary CLI profile discovery, prove hostile binfmt/kernel
policy absent, package a signed production profile, or supply macOS/Windows
confinement. See Linux production offline doctor provisioner v1.
The separate semaprax-doctor-release::install library boundary owns a
Unix-only, explicitly selected signed-generation store. It retains the exact
private root authority for the store object's lifetime, replays signed release
bytes through held files, publishes immutable generations without adoption,
and changes the fixed ACTIVE record only under a cooperative lock and an
expected-current check. Recovery authenticates the complete held inert-stage
inventory before its first effect. This layer does not execute a generation,
activate the ordinary CLI, provide a kernel compare-and-swap against hostile
same-principal writers, or add Windows support. See Signed doctor generation
install v1.
The collector's lifetime state owns authentication, the irreversible reap transition and
fixed handle closure; only the native adapter performs pidfd and descriptor
operations. The separate report-delivery module owns bounded writes and final
standard-pipe closure after collection. Resource-free scripts exercise the same
state transitions without constructing observations or process authority.
The retained safe semaprax-native-rust-interop-platform facade and platform-sys
quarantine's separate doctor/ module are no longer connected to that CLI route.
This lower-level fixed --version probe owns bounded combined
output, deadline observation, and private Unix-group or Windows-job settlement;
it does not alter the authenticated build runner. The private CLI retains report
policy and UTF-8/version parsing, with no unsafe code. Native64 little-endian
Linux x86-64/AArch64 probes additionally install an inherited no-new-privileges
and seccomp syscall-denial layer before exec; unsupported Linux ABIs and setup
failures cannot fall back to unfiltered execution. Its argument-filtered Unix
stream/seqpacket pairs preserve the Rust fork/exec handshake; datagram pairs,
socket creation and named connection/listen/accept operations remain denied.
Its trusted installed tools still
lack complete no-network isolation, including discovery, filesystem and broker
paths; macOS/Windows isolation is unchanged. See the doctor lifecycle
contract.
Canonical source
src/lexer.rs, src/parser.rs, and src/ast.rs parse human-readable source.
The parser separates recursive prefix atoms from postfix construction so
inactive postfix temporaries do not accumulate during nested atom parsing.
Token order, contextual grammar, spans and diagnostics are unchanged.
src/parser/patterns.rs holds match-pattern parsing and src/parser/types.rs
type syntax, both moved verbatim, and src/parser/hints.rs attaches fix hints to rejections of habits from other
languages (return, for, else if, expression statements, compound
assignment, tuples, indexing, Some(x) patterns, struct/enum/pub/const
declarations, missing trailing commas, missing or unit result types, valueless
blocks) without admitting any new syntax or changing a stable code.
src/format.rs is the canonical source projection. Revision digests bind the
canonical bytes, not incidental whitespace.
Source is the canonical Git representation. A managed workspace publishes an immutable generated source set for cooperating readers; it does not rewrite the original files or grant atomic visibility to Git, editors, or arbitrary raw path readers.
Validated HIR
src/verify.rs, src/source_verify.rs, and src/hir.rs own checked meaning.
The src/hir/ modules own validation, inspection indexes, declaration lookup,
and bounded Project linking.
HIR carries resolved identities and typed operations. A backend or report may apply a stricter admission profile, but it may not reinterpret unresolved AST or silently widen the verified program.
Cleanup meaning
src/cleanup.rs inventories structurally owned leaves.
src/cleanup_plan.rs and src/cleanup_plan/ own the target-neutral cleanup
control-flow schema, builder, validation, execution model, and independent
replay.
Current graph versions select the minimum schema needed by the admitted feature, from legacy scalar/Result meaning through Option, aggregates, generics, loops, byte data, command I/O, and owned-byte record/variant matching. The owning feature specifications define exact schema numbers and preservation requirements; architecture depends only on monotonic, deterministic selection.
Owned Byte Variant Algebra v1 is the
closed non-Copy sum slice. Cleanup Inventory v2 identifies owned leaves by
stable case and field identity; CleanupPlan v6 authenticates conditional entry,
selected-case transfer, and exact case liveness; Graph v22 projects those
facts. Interpreter, native, and Wasm lower only the active case field-by-field.
Invalid owned tags or tag/liveness disagreement fail-stop before payload
authority, cleanup, or result publication. Exact authored generic one-owned and
two-owned profiles plus compiler-owned Result<Bytes, Bytes> reuse this
conditional path. The exact compiler-owned
Result<Bytes, Bytes> -> Result<Bytes, Bytes> postfix-? path evaluates once,
moves the selected Ok payload, transfers the Err residual to provisional result
storage, and joins ownership inventories before shared postconditions. Cleanup
replay groups only equal control/staged-result states at topological joins and
retains both guarded cases for failure cleanup; interpreter, native O0/O2, and
Core-Wasm consume that same authenticated plan locally. Mixed/general/nested
owned propagation, generic-function carriers, Project/public aggregate ABIs,
hosted promotion, and general resource variants remain outside this boundary.
Owned Bounded Byte Buffer v1 is one exact
internal write-once collection profile: a literal-bounded bytes_zeroed
allocation followed by at most 256 nested literal-index bytes_set owner
transfers, then an immutable binding. Source and HIR independently authenticate
the chain, and CleanupPlan transfers one owner through every call commit so only
the frozen binding is finalized. The interpreter, native O0/O2, and internal
Core-Wasm execute that same profile locally. Core-Wasm uses the frozen
env.spx_bytes_zeroed/env.spx_bytes_set host-arena protocol, mutates the same
opaque token, emits neither memory.copy nor memory.grow, and settles before
re-entry. The public byte adapter rejects the profile with SPX-W115; loops,
growth, wider elements, Project/public layouts, std.*, browser/hosted and
cross-platform support remain outside this boundary.
src/loan_plan.rs owns the additive plan schema, builder, and replay;
src/graph_loan.rs owns its Graph projection. The
Shared Loan Plan v1 is a bounded, target-neutral proof
plan for synchronous immutable loans. It assigns dense
resolved-function-local loan identities, authenticates exact owner places and
parent reborrow provenance, and records path-sensitive last-use edges for
multiple loans. Validated HIR independently rebuilds and exactly replays the
plan before Graph v23/v24 may project it. Try propagation retains distinct normal
and residual-return CFG successors so later uses cannot extend a loan across
an early return. When the same module also carries owned-variant Graph v22
facts, additive Graph v32/v33 serialize the complete conditional cleanup and
unprojected/projected loan contracts together; Semantic Workspace admits those
exact schemas and continues to reject unknown spellings. The plan neither changes CleanupPlan
liveness nor creates runtime
references; legacy programs retain their prior Graph and cleanup bytes.
The implemented additive
Projected Owned-Byte Field Shared Borrow v1
preserves one direct stable field-ID projection through byte-slice provenance,
aliases, ranges, and the same plan. Additive Graph v24 owns the new facts while
unprojected Graph v23 schema selection and serialized fields remain unchanged.
The interpreter, native C11, and
Core-Wasm lanes lower that exact profile.
The admitted profile has hosted-green release evidence. General borrowing and
public borrowed ABIs remain outside this boundary; separately implemented nested
record profiles retain their own loan and cleanup contracts.
The authored Acyclic Nested Owned-Byte Records v1 tranche extends only the internal monomorphic record tree. Source and HIR independently derive bounded complete stable-field-ID paths; CleanupPlan v7 owns recursive construction, whole moves, call commits and reverse cleanup; Graph v26/v27 distinguish nested ownership from nested projected loans. Interpreter, native C11 and Core Wasm consume that validated meaning without shallow owner copies. Project, FFI, package and Component boundaries remain closed, and the tranche is not promoted until its three-engine and hostile-plan gate executes.
The additive Concrete Generic Owned-Byte Records
v1 composes the flat projected-byte
cleanup path with exact generic-record substitution. Only concrete authored
record instances whose recursively substituted leaves are Bytes or Copy scalars
are admitted. The Copy closure is exactly i64, i32, u8, usize, char,
f32, f64, and bool. One narrower generic-function path relays exactly one
owner through an identical parameter/result type for any bounded acyclic
authored-record template tree, with every type argument explicit and in that
Copy closure. Box<Pair<Bytes, T>> and Pair<Box<Bytes>, T> are the two
focused representative nestings. Source verification and HIR independently
authenticate the template, concrete instance, nested type and ownership; Graph
v14 and CleanupPlan v7 remain unchanged. Source verification, validated HIR,
cleanup inventory/replay,
interpreter, Native64 layout/emission, and Wasm32 layout/emission each derive
the same concrete field types; target layout is never substitution authority.
Nested-nonflat generic composition with multiple owners or non-identical
results, generic classes/variants/resources, Project, FFI, package, Component,
and public ABI surfaces remain closed. The legacy flat generic-function
admission is unchanged.
Generic templates in those two admitted function profiles may now forward directly to another admitted generic template when the callee arguments are the exact caller-owned type-parameter vector in declaration order. Source verification and HIR derive a deterministic transitive closure of at most 256 corresponding concrete function instances and reject cycles, remapping, permutation, missing instances, and profile drift before execution. This reuses Graph v14 instance/call identity and the existing CleanupPlan v2 scalar, v5 flat-owned, or v7 nested-owned transfer meaning. It does not admit construction, projection, variants, resources, effects, inference, constraints, non-identical owning results, or a public generic ABI.
The ScalarV1 ResolvedProgram classifier has one implementation-only extension
of that profile: any exact reachable body may compose the admitted flat
concrete generic owned-byte record internally, independent of source or
dependency provenance. Every callable and selected export retains its frozen
value-scalar signature, so the public scalar descriptor and
Core-Wasm/JavaScript/TypeScript adapters do not carry the record, template,
instance, layout or owner. Exact Subject-v3/Report-v2 replay provides the
cross-package fixture, whose sole exposed function is fn() -> i64; it is
evidence for the general body classifier, not an origin selector. Project-local
authored generics, use type, aggregate cross-package signatures and public
aggregate ABIs remain closed. This changes no manifest, package report,
Project, descriptor, Wasm or package-semantic-graph schema and grants no
acquisition or publication authority.
The additive Acyclic Nested Owned-Record Exact Destructuring
v1 consumes the same bounded record
shape and stable paths for recursive match own and match borrow only.
CleanupPlan v8 authenticates the exact recursive pattern and atomic whole-owner
transition; Graph v28/v29 distinguish destructuring without and with an
authenticated nested projected loan. The interpreter, native C11 and Core Wasm
remain fieldwise, while variants, mutation and every public ABI stay closed.
The successor Acyclic Nested Owned-Record Immutable Update v1 admits only top-level immutable reconstruction of that same closed record tree. CleanupPlan v9 authenticates unchanged descendant transfers, replaced-old settlement, replacement-prefix completion and one result commit; Graph v30/v31 distinguish reconstruction without and with universally authenticated nested loans. Interpreter, native C11 and Core Wasm remain fieldwise. Dotted mutation, resources, variants, generics and public ABI surfaces remain closed.
Semantic graph
src/graph.rs and src/graph_cleanup.rs project validated program and cleanup
meaning. src/graph/generic_instances.rs owns additive Graph v34 instance
ownership and exact source replay; src/graph/generic_mapping.rs owns Graph v35
symbolic forwarding projected through authenticated template-to-instance
expression paths. Identity-only mappings retain Graph v34 bytes. Frozen
versioned consumers explicitly use the legacy projection. src/cleanup_plan/replay/schema.rs independently selects
the cleanup schema from HIR with a freshly rebuilt inventory. The builder and
replay must agree before any execution. The canonical workspace's
canonical_workspace_revision/generic_instances.rs embeds the linked closures
in SemanticProgram v2, which the existing ProgramRoot segment authenticates. src/call_index.rs, src/impact.rs, src/review.rs,
src/properties.rs, and src/hygienic.rs build bounded read-only views over
verified representations.
src/source_verify/function_value_inventory.rs owns lexical bare-reference
inventory and conservative callback dependency candidates for Function Values
v1; src/hir/function_value.rs independently authenticates the admitted target
universe and signatures. src/graph/function_values.rs owns the additive Graph
v36 callable type, reference, invocation, candidate-target, and target-universe
facts. src/project/canonical_workspace_revision/generic_instances.rs retains
their exact graph strings in SemanticProgram v3. These modules keep function
identity in checked declarations rather than source names, backend addresses, or
Wasm table indexes.
src/iterator_ops.rs owns the closed scalar Iter<T> / IterStep<T> identities
and consuming operation signatures. src/prelude.rs selects additive Prelude
v7 without rewriting v1-v6 bytes; src/cleanup/iterator.rs and
src/cleanup_plan/build/iterator.rs derive the v10 lifecycle and conditional
Yield/rest owner path, while replay independently rederives it. Graph v38,
workspace prelude binding, cache tokens, and ProgramRoot retain the selected
types, consuming calls, cleanup schema, and exact v7 contract. Native and Wasm
lowering consume that checked representation; the profile has no public ABI.
src/hir/resolve_for_own.rs lowers consuming traversal to one hidden Step slot,
a borrowed Done/Yield condition, and an owning Step replacement. The independent
src/hir/iterator_loop.rs recognizer authenticates the mutable seed and complete
loop protocol; src/hir/validation/iterator_loops.rs preserves the ordinary
body admission and exact ownership boundary. Cleanup build and replay select
v11, and graph selection independently binds it through v39. Wasm borrowed
remainder bindings alias the active payload; consuming moves may clear only a
distinct source slot. Native conditional owners stay in canonical plan storage.
src/hir/iterator_loop/renewal.rs recognizes only compiler-owned same-owner
Vec intrinsic assignments in If branches of an authenticated for own body.
src/cleanup_plan/build/renewal.rs derives the reserved cleanup position and
renewal edge, while src/cleanup_plan/replay/renewal.rs independently
authenticates them before execution. src/wasm/aggregate/post_transitions.rs
is the Wasm post-transition child that consumes those replayed facts; it does
not select reservations or grant runtime authority. Source and HIR generic
collection classifiers admit the bounded one- or two-type-parameter operation
shape; cache encoding retains its exact ordered type vector and renewal facts.
The additive owned-payload iterator is split across
src/interpreter/iterator.rs, which validates the initialized suffix and uses a
detached-prefix sentinel for the moved slot, and
src/codegen/native_iter/owned.rs, which changes the native authority kind,
zeroes the moved Vec slot, and settles only the remaining suffix. Core Wasm
imports and lowering live in src/wasm/aggregate/iterator_ops/owned.rs; its
separate iterator authority prevents Vec operations from accepting iterator
carriers. These modules consume the selected Prelude v8, CleanupPlan v13, and
Graph v45 facts; the admitted native/Wasm regression corpus is HOSTED GREEN for v0.4.0.
Function Values v2's private generic-collection profile is owned by
src/source_verify/declared_type/generic_collection.rs and
src/hir/generic_collection.rs; src/hir/validation/generic_template.rs
rechecks its substituted callable expressions and mutable collection bodies.
The template cycle graph uses persistent template declaration identities. Every
materialized generic call separately carries a FunctionInstanceId derived from
that template identity and its exact substituted type vector, so callback
spelling cannot alter a cycle or instance edge. Callable parameters are Copy
Value slots with no cleanup owner; only the admitted Box<T>/Vec<T> carrier
slots remain Own. Source and HIR substitution preserve those parameter modes
while rechecking the concrete callable signature before normal cleanup and
backend lowering.
Scalar Snapshot Closures v1 is checked by src/source_verify/closure.rs and
independently by src/hir/closure/ and src/hir/validation/closure.rs. Each
creation expression owns a derived private function identity and an ordered
inventory of scalar place snapshots. Ordinary runtime/ownership visitors inspect
capture reads; the body is a separate checked function with its own loan and
cleanup plans. src/graph/function_values.rs adds Graph v37 body definitions and
capture facts, retained by SemanticProgram v5. The interpreter retains the
compiler-derived body products. Native native_emit/closure.rs uses typed
entry thunks and eight scalar cells; wasm/closure.rs uses environment-aware
table adapters and caller-owned aggregate frame slots. Copies and returned
closures preserve snapshots without transferring any owning payload. See
the closure contract for bounds and release regression evidence.
The generic construction extension uses
src/hir/closure/materialize.rs to substitute scoped types and rebuild private
body identities from exact concrete creation sites. Source verification checks
every admitted scalar substitution, including unused templates. The graph
retains symbolic template closure bodies separately from the executable
inventory; only concrete bodies reach interpreter and backend target tables.
A graph, report, review, or evidence capsule is descriptive data. It is not a capability, signature, approval, or commit token.
Target Evidence reports the pinned wasmparser 0.258.0 validator. Validator version facts participate in report hashes and Evidence v2 replay; dependency updates require capsule regeneration without granting target execution or publication authority. See Target Evidence v1.
Compiler and execution lanes
Interpreter
src/interpreter.rs evaluates an admitted verified-HIR profile with bounded
fuel and normalized runtime statuses. src/hosted_interpreter.rs adds the
bounded host-facing execution used by Project profiles. The interpreter is a
development and conformance lane, not a target backend or proof engine.
src/interpreter/internal_strings.rs owns the additive interpret-strings
facade and strict report boundary. A private profile selects internal String
callee admission and a distinct report schema/domain through the existing
source evaluator and renderer. External scalar/borrowed inputs and scalar
results stay unchanged; ordinary, Project, prepared, and effectful evaluators
retain their prior admission. This route adds no second execution engine or
target runtime. See Internal String Interpreter v1.
src/interpreter/prepared.rs owns the additive cached closure/index types,
cooperative cancellation seam, prepared evaluation entry, and expression-trace
traversal hook. The root interpreter retains the shared evaluator and only the
minimal crate-private reexports needed by the Project lane.
src/project/prepared_interpreter/ adds an authority-neutral retained Project
lane over the same evaluator. It caches the exact admitted entry/test closure
indexes once, owns one sequential fixed-stack worker, observes monotonic
cooperative cancellation only at evaluator step boundaries, and emits bounded
semaprax.project-source-trace.v1 expression origins. Plain replay proves the
closed canonical wire; revision-bound replay additionally matches every event
to retained HIR and authenticated source facts. It does not independently
re-execute the dynamic path and grants no debugger, target, I/O, build, or
publication authority.
Within the retained Project lane, model.rs owns the public prepared options,
outcomes, cancellation handle, and worker-slot model; origin.rs owns exact
entry/test source-origin indexing and duplicate-fact disagreement checks; and
worker.rs owns fail-fast execution admission, the bounded fixed-stack worker
lifecycle, evaluation/cancellation dispatch, and trace assembly.
worker/untraced.rs adds explicit outcome/fuel-only requests on that same
worker, using the evaluator's existing zero-event path without rendering a
trace; it shares admission and revision replacement with traced requests.
worker/replacement.rs owns the additive expected-revision check and complete
prepared-state handoff. Execution and replacement share fail-fast admission;
the existing worker prepares both candidate closures and origin facts before
swapping them together with their immutable revision. Ordinary rejection
preserves the old state; a panic or lost replacement acknowledgement makes
the worker terminal. This adds no filesystem refresh or incremental compiler
cache. See Prepared Project Revision Replacement v1.
Within that lane, trace/model.rs owns the closed wire vocabulary, digest
domain, normalized status parsing, and trace data model; trace/render.rs owns
bounded prefix selection and canonical rendering; and trace/verify.rs owns
closed-wire replay plus revision-bound closure/source checks. This split and
its focused evidence are authored but unpromoted; the completion matrix remains
the sole status authority.
src/resumable_effects/lowering.rs owns the deterministic ordered-state HIR
plan for one to eight direct sequential, Copy-scalar source yield sites. It
derives exactly bound per-site suspension identities and independently
validated, yield-free start and per-site resume projections;
src/interpreter/resumable.rs consumes the same plan identities plus an opaque
in-memory scalar request/answer history for source replay. This is not live
frame or liveness lowering. Projection retains the
selected function and authored-entrypoint direct-call closures in authored
order, prunes disconnected functions and correlated declaration-index facts,
and rederives byte provenance. Retained functions must remain explicit,
effect-free and Copy-scalar with no owned cleanup; authored nominal/authority surfaces,
generic calls, function references and retained yielding callees fail closed.
src/resumable_effects/target.rs owns the public, authority-free production
preparation profile for those already authenticated projections. It emits an
exact bounded inventory of deterministic native C11 source or Core-Wasm bytes
in memory, binding each artifact to the plan, target, projection role/state,
selected entry symbol, and artifact bytes. Native projections suppress the
ordinary program-entry wrapper and expose only their plan/site-specific wrapper
as the selected resumable entry. Emission is capped while backend sinks build
the artifact; preparation performs no compilation, execution, publication,
host call, or checkpoint recovery. Ordinary backend entry points continue to refuse
source yield directly. The crate-private src/resumable_effects/backend/
runners remain cfg(test)-only and execute the prepared semantic projections
through local native C11 and Core-Wasm target paths as parity evidence. Their
test process explicitly owns its temporary storage and local clang/Node
process use; production library code and generated programs gain none of that
authority. The preparation profile adds no public continuation ABI, scheduler,
or checkpoint authority. Covered
arithmetic and contract failures retain exact normalized statuses; arbitrary
NaN payload preservation is not claimed across the JavaScript Number test
adapter. Ordinary backend emission retains its explicit yields refusals.
src/resumable_effects/source_checkpoint.rs wraps the admitted sequential
scalar continuation in a bounded canonical public envelope. A caller-owned
256-bit HMAC key authenticates the continuation together with exact
caller-supplied ProgramRoot, invocation and policy-epoch facts, preventing an
untrusted store from rebinding answer history across those scopes. Decode
rechecks the tag and facts, re-lowers the current checked program and
reconstructs an inert continuation; the zeroized key grants no effect or resume
authority, and the codec performs no dispatch or persistence.
Resumable Effects v1 owns the bounded contract and
remaining general-lowering/runtime gaps.
Native bootstrap backend
src/https_client.rs owns a separate explicit native-host HTTP service. Its
reusable Reqwest client disables ambient proxy discovery, applies bounded
redirect/body/pool policy, and reports HTTP/1.1 or HTTP/2 through a typed
response. Hosted source execution reaches it only through the explicit
network.http capability and injected provider; it grants no compiler or
generated target ambient network authority. src/network_provider/tcp.rs
owns the lower Rustls client/server stream policy, including explicit
server-config injection and accepted-stream settlement. See HTTPS Client
Runtime v1.
src/interpreter/network.rs owns source-visible GET/POST capacity and status
boundaries described by HTTPS Client I/O v1 and
v2. The POST destination policy remains host-owned;
fixture v4 binds exact request bodies without granting physical network authority.
src/outbound_host_adapter/ owns the higher-level issue-#193 host boundary for
structured operational exports and signed webhooks. It consumes one explicit
deployment capability, validates bounded request policy before one injected
adapter call, and emits authority-free replay evidence. Its native Reqwest
adapter disables ambient proxies, redirects, and retries; custom Rust adapter
implementations remain trusted host code rather than a sandbox boundary. See
Outbound Host Adapter v1.
src/wasm/http_io.rs and src/wasm/aggregate/http_io.rs own its distinct
Core-Wasm import/status boundary and owned-result authentication;
src/project/npm/https_command.rs and https_runtime.mjs own the replayable
Project-v13 fixture-v3 carrier. Those generated adapters grant no ambient
browser fetch, Node socket, TLS-key, or WASI authority.
src/codegen/native_emit/http_io.rs owns the distinct Project-v13 native C11
HTTPS runtime and command runner. It embeds the pinned
src/codegen/mozilla-roots.pem trust projection, configures bounded libcurl
TLS/HTTP policy, canonicalizes the complete response, and settles its
invocation-owned handle before publication. src/codegen/native_emit/compiler.rs
owns the narrow -lcurl link route; ordinary native profiles retain their
existing linker inputs. The explicit test-CA override exists only in generated-C
loopback tests and is never selected by production emission.
src/structured_tasks.rs owns the bounded Rust scoped-thread runtime and its
invocation-owned HTTPS task adapter. A provider moves into one lexical task,
settles exactly once on every exit path, and publishes a typed result only
after settlement. Pre-start cancellation prevents transport; started blocking
I/O drains, and a late response is discarded against a bounded caller-selected
deadline. This is host runtime behavior, not SEMAPRAX task syntax or native/Wasm
task lowering. See Structured Tasks Runtime v1.
platform-tests/https-browser-v1 owns the provisioned Chromium consumer for
the generated Project-v13 npm carrier. Its loopback server exposes only the
committed harness and a separately generated package; the browser test
authenticates Wasm through the generated runtime, proves one-shot invocation
and hostile-byte rejection, and records every request origin. This gate proves
fixture-provider browser execution without granting ambient browser fetch or
live public-network authority.
src/codegen.rs owns native orchestration and admission. The
src/codegen/native_* modules own C11 emission, runtime statuses, aggregate
and byte-data lowering, command I/O, callable bundles, resource fixtures,
capability envelopes, conformance traces, and private host contracts.
The public executable lane emits C11 and invokes the host's clang command.
The compiler and legacy single-source CLI share the private
src/native_scratch.rs helper for exclusive temporary-directory creation,
retained file identity, and explicit fixed-inventory cleanup. Failed or uncertain
work retains its scratch; this does not add a deleting destructor, process
sandbox, or the SDK builder's separate held-tool authority. See
Native compiler scratch v1.
Private callable and resource lanes are narrower host-integration evidence;
they do not establish a stable general native ABI.
native_emit/owned_strings.rs also owns the authored ordinary/stdout inline
String ledger. Only String-bearing functions stage bounded output for hoisted
owner cells; String-free functions retain direct emission. Ordinary String
helper discovery includes materialized generic instances as well as
monomorphic functions. The authored owned-data provider correction
extends the same ledger, length-header runtime, and instance discovery to v8/v9
provider emission without widening public or Project admission. Full provider
translation units with Strings intentionally change; String-free output,
v10 selection and versioned command projections remain unchanged.
See Native Inline String Settlement
v1 for exact compatibility and open gaps.
The ordinary/stdout runtime selector also reuses the existing length-header
String helpers to preserve embedded NUL. Representation selection is separate
from v10 provider carrier support, so this does not add byte-carrier machinery
to ordinary String-only output. See Native String Contents
v1.
WebAssembly backend
src/wasm.rs and src/wasm/ emit Core WebAssembly and generated host
carriers for admitted profiles. Scalar, selected aggregate, text, byte-data,
owned, and command-I/O paths remain separately admitted. The owned-byte variant
path uses active-case field moves and hard traps for malformed carriers; legacy
Copy-variant status behavior remains unchanged. The default product
is not a general WebAssembly Component Model runtime.
The separately selected wasm::internal_strings API authors a standalone
String-settling profile. internal_strings/admission.rs owns selection and
static work limits; aggregate/internal_strings.rs owns the new ten-import
module and checked mint lowering, reusing the private String owner cells and
common status epilogue. The existing aggregate entry points explicitly leave
that mode off. Generated modules pass structural validation before return.
internal_strings/runtime/ separates exact input/artifact admission, bounded
UTF-8 arena ownership, and a scalar-only poisoned-on-uncertainty facade.
The shared aggregate/expressions.rs keeps recursive scalar dispatch and block
statement lowering separate from inactive aggregate-arm temporaries. The
aggregate.rs expression wrapper still applies canonical post-transitions and
String scope cleanup exactly once, after the selected handler returns.
Capacity refusals run generated cleanup; unexpected traps do not promise
settlement or permit reuse. See Standalone Wasm Internal String Settlement
v1 for selected local
evidence and remaining gates; ordinary Wasm
imports, Project v1-v10 and Target Evidence do not select this profile.
internal_strings/web.rs and its small rendering/template modules expose that
profile through an explicit source-only Web build selector. The early CLI
branch bounds and authenticates the source snapshot before compilation and
rechecks it before reusing the existing fresh-output scalar Web publisher.
Its eight-file package preserves exact compiler/runtime outputs; a separate
manifest binds artifacts, while the local browser console authenticates the
descriptor before constructing scalar controls. Legacy build_web rejects
String-bearing ordinary and materialized generic functions before output
creation because its runtime lacks those imports. Raw emission and successful
String-free legacy packages stay unchanged. See Standalone internal String Web
package v1 for selected
local consumer and boundary evidence; required host/release gates remain open.
src/wit_component.rs and src/wit_component/ provide default-off private
boundary evidence. They cannot be cited as public Component Model execution.
src/project/scalar_wit.rs projects an already admitted retained Project-v1
scalar surface into a public, authority-free WIT interface artifact. Stable
declaration IDs become injective hexadecimal WIT names, parameters use ordinal
identities, and every scalar result is represented as result<T, status>.
Its canonical subject-bound descriptor is independently replayed against the
retained manifest, HIR, revisions, graph digest, selected order and regenerated
WIT before exposure. This path emits no Core Wasm or Component bytes, performs
no I/O, and does not promote the private Component harness.
Shared runtime status
src/runtime_status.rs, src/semantic_trace.rs, src/conformance.rs, and
src/trace_path_certificate.rs normalize failures and execution traces. The
first selected failure is sticky: cleanup cannot replace it, and result
publication occurs only after postconditions and non-result cleanup.
Agent query and mutation architecture
Single-file queries and changes
src/agent_transport.rs serves a bounded JSON-RPC loop over one checked
program. src/patch.rs owns the supported single-file transaction format and
A0 commit boundary. src/repair.rs, src/impact.rs, and src/review.rs are
read-only planners and projections.
src/patch_evidence.rs independently reconstructs supported evidence. The
evidence-gated apply route acquires ordinary A0 authority first, replays before
staging, and rechecks the unchanged source before commit. Ordinary patch
remains a separate legacy route.
Managed workspace
src/workspace.rs owns immutable generations and the authenticated ACTIVE
pivot. src/workspace_patch_evidence.rs binds exact per-file child evidence
and replays it before candidate creation.
src/semantic_workspace.rs, src/workspace_graph.rs, and
src/workspace_analysis.rs own cross-file initialization, graph construction,
context, impact, and review. src/semantic_workspace_change.rs and its modules
own replacements-only evidence and publication. Operations and structural
change are separate, bounded derivation layers in
src/semantic_workspace_operations.rs and
src/semantic_workspace_structural_change.rs.
Only the live workspace invocation owns the final publication pivot. Evidence capsules never carry reusable authority.
Operational semantic images
src/project/agent_lowering.rs lowers verified .spx Agent declarations
through the frozen AgentDefinition v1 compiler and returns stable-ID-ordered
HIR-equivalent Agent nodes plus exact AgentDefinition/AgentGraph/Runtime Profile
products. src/project/build.rs and src/project/revision.rs retain those
products as immutable Project facts.
src/project/canonical_workspace_revision.rs derives the authority-free
Canonical Semantic Workspace Revision v1 from one already admitted immutable
ProjectRevision. It owns nine distinct typed node projections and keeps the
semantic, exact source projection, canonical Project manifest, and admitted
dependency-closure digests separate before binding their four digest strings
into one composite canonical revision. Replay always rederives the complete
object and exact-compares caller bytes; it never trusts serialized HIR or grants
mutation, cache, service, or publication authority. Existing Project, managed
Workspace, and Semantic Workspace Image v1 bytes and revision algorithms remain
unchanged. See Canonical Semantic Workspace Revision
v1.
The canonical workspace's existing AgentDefinitions node has two distinct
population paths. The explicit bridge accepts a bounded stable-ID-ordered list
of compiler-admitted definition/graph/profile bundles. Language-native .spx
Agents are instead retained by ProjectRevision and selected automatically;
their source-only rows also carry exact replayed Proposal and Observation
contract facts. Both paths flow through the same ProgramRoot segment and grant
no runtime or external authority. See Explicit AgentDefinition Association
v1 and Agent Interaction Contract
Facts v1.
src/project/program_root.rs adds the SEG-02 ProgramRoot v1 foundation as a
small content-addressed manifest over that same canonical workspace object. It
does not derive a competing program graph: nine ordered segment descriptors
bind the existing typed node schemas, digests, and exact byte lengths without
copying or deserializing node payloads. DeploymentRoot, InstanceRoot, and
EvidenceRoot are typed, compiler-created unbound relationships only. ProgramRoot
derivation and replay are authority-free, and the legacy canonical workspace,
Project, Image, and Graph bytes and identities remain unchanged. See
ProgramRoot v1.
src/project/interface_artifact_facts.rs and
src/project/program_root/dependency_lock.rs provide the next SEG-02 inputs
without widening the frozen v1 root. The first freshly derives exact existing
Project interface descriptors and selected pathless Image artifact reports.
The second delegates exact caller-supplied semaprax.lock admission to Project
Lock v1 and privately retains the admitted bytes for later replay. Both expose
typed, content-addressable fact bundles; neither is inserted into ProgramRoot
v1. A versioned exact ProgramRoot context must bind them before service/query/
transaction selectors may claim the enriched root.
src/project/program_root/v2.rs and
src/project/exact_program_context.rs provide that additive exact selector.
ProgramRoot v2 retains the enriched workspace's nine v1 descriptors and appends
the interface/artifact and Project Lock association descriptors while naming
the distinct default Project root explicitly. ExactProgramContext retains all
typed inputs and requires both enriched workspace and v2 root digests. The
semantic service, universal query, transaction, and structural diff expose
additive in-memory exact entry points; their existing serialized contracts stay
unchanged. Exact refresh and candidate-v2 identity fail closed until Project
Lock replay has a candidate-safe authenticated input owner.
src/project/contracts_and_tests_facts.rs derives a separate bounded
contract-association and declared-test inventory from the admitted Project's
retained HIR. Stable-ID-sorted function and function-template rows carry
ordered requires/ensures expression facts; the test inventory contains only
the declared test main and executable named tests selected by the ordinary
Project rule. The object explicitly claims neither contract proof nor coverage
nor test execution. src/project/program_root/v3.rs freshly derives ProgramRoot
v2, retains its eleven descriptors and three unbound relationships exactly,
and appends a descriptor for this fact bundle. Neither layer changes Canonical
Semantic Workspace Revision v1 or ProgramRoot v1/v2 bytes. See Contracts and
Tests Facts v1 and ProgramRoot
v3.
src/project/exact_program_context/v2.rs owns the additive ProgramRoot-v3
selector. It independently replays exact context v1, contract/test facts, and
ProgramRoot v3, then requires the enriched workspace and v3-root digests on
every exact route. Query, transaction, service, and service-history adapters
retain v3 (and where applicable v2) only on typed in-memory results; their v1
wires remain unchanged. Exact transaction history still binds the authenticated
default Project-derived base workspace. Its candidate-refresh bridge
independently replays current and host-authenticated successor contexts against
a separately compiler-admitted candidate revision. The semantic service stages
the candidate generation, cache, unchanged receipt, and history entry before
one exact adoption; failure preserves all installed state. No external fact is
copied from the current root, and no serialized root becomes trusted state.
See Exact Program Context v2.
src/project/semantic_transaction.rs owns the bounded authority-free Universal
Semantic Transaction v1 kernel. It binds an exact canonical workspace revision
and admits a closed one-operation algebra containing a typed display rename and
a typed whole-function ReplaceBlock. Both delegate to immutable
ProjectCandidate machinery and derive canonical impact, review, result, and
exact-replay evidence. ReplaceBlock authenticates the old body span, then
requires exact prefix, suffix, and unrelated-source equality after the complete
candidate rebuild. The shared comment-free canonical source guard prevents the
reused candidate formatter from introducing other trivia changes. It has no
filesystem or publication authority. See Universal Semantic Transaction
v1.
src/project/semantic_transaction_v2.rs owns the additive Universal Semantic
Transaction v2 ReplaceExpression kernel. It selects an actual revision-scoped
HIR expression identity, authenticates its exact old source slice, delegates
the typed rewrite and complete Project rebuild to ProjectCandidate, and
independently proves source preservation outside the selected expression. Its
versioned artifacts and replay are authority-free and leave every v1 byte
unchanged. See Universal Semantic Transaction v2.
src/project/semantic_transaction_composition.rs owns Universal Semantic
Transaction Composition v1. It derives an exact four-component/nine-node
structural diff from a validated Candidate, rebases one RenameDisplayName
transaction onto an independently admitted canonical workspace revision, and
merges two distinct-target sibling rename transactions in one explicit order.
It freshly validates transactions and delegates reconciliation, conflict
selection, and complete source replay to Project Candidate; it does not fork a
second merge engine. Rebase remints one ordinary v1 transaction and requires
exact Candidate parity. Merge returns a validated Candidate and explicitly is
not a multi-operation v1 transaction. All outputs are bounded immutable
evidence with no commit, generation-pivot, transport, or publication authority.
See Universal Semantic Transaction Composition
v1.
src/project/semantic_query.rs owns the transport-neutral Universal Semantic
Query v1 core. Its closed canonical request/result boundary binds every read to
one Canonical Semantic Workspace Revision and exposes exactly five operations:
bounded Project declaration paging, image symbol lookup, Workspace Analysis
context and impact, and installed transaction-operation availability. The
availability projection calls the same read-only rename classifier that
transaction validation uses; it does not duplicate eligibility policy or
validate an arbitrary proposed name. Queries execute against one immutable
service snapshot, exact replay re-executes and compares the complete result,
and neither route mutates the service. There is no wire, CLI, MCP, LSP, editor,
streaming, or publication adapter in this badge, and frozen Project Agent
Transport v5 bytes remain unchanged. See Universal Semantic Query
v1.
The same module also owns the additive in-memory AgentDefinitionsQuery; it
selects the existing canonical node without extending the closed wire grammar.
src/project/semantic_service.rs owns the transport-neutral, process-resident
Persistent Incremental Semantic Workspace Service v1 core. One service retains
one immutable current generation, including its admitted Project revision,
Canonical Semantic Workspace Revision, Semantic Workspace Image, and
compiler-created semantic cache. Refresh builds a complete successor from
caller-owned source bytes, then performs one expected-current in-memory
generation/cache compare-and-swap; stale or failed work leaves the complete old
generation installed. Revision-bound snapshots delegate bounded symbol,
context, impact, and Universal Semantic Query v1 operations to the retained
immutable image and Project. Transaction validation delegates to Universal
Semantic Transaction v1 or the additive v2 ReplaceExpression kernel and returns
authority-free artifacts without adopting the candidate or changing current
state. The core opens no path, owns no disk store, and exposes no wire, CLI,
MCP, LSP, editor, watcher, build, execution, commit, or publication route. See
Persistent Incremental Semantic Service
v1.
src/project/workspace_execution.rs owns the exact SEG-04 binding selector and
receipt replay for one retained service generation and its selected
ProgramRoot; it accepts no caller-supplied root decoding or authority. Its
runtime.rs child owns the consuming bind_once, bind_iterative, and
bind_typed delegates and joins evidence only from the producer run that
actually executes. Typed run_current holds the service borrow across the
freshness check and run; typed durable execution delegates the existing
caller-owned trusted checkpoint store. These modules add no snapshot
structure, disk store, wire, MCP, CLI, task/proposal authority, or migration
association, and preserve historical bindings across refresh while rejecting
stale current execution.
src/project/workspace_execution/runtime/migration.rs owns the bounded
workspace-to-workspace migration child. It consumes matching old and
destination workspace runtime producers plus actual durable Suspend evidence,
verifies provenance, and delegates pure migration and recovery to the existing
state-migration/runtime producers. It emits a public migration association
only from the checked bindings and actual run evidence; receipt replay
reconstructs fresh retained state and exact-compares canonical bytes. The
child keeps checkpoint-store authority caller-owned, permits recovered runs
only through the durable path, and checks destination currentness before any
stage, store, or host operation. It adds no disk store, service wire, MCP, CLI,
snapshot structure, task/proposal authority, or automatic retry.
src/project/semantic_service/history.rs owns the bounded immutable snapshots
and revision-bound queries over successful validation and refresh outcomes;
failed attempts append nothing, and ordering means only mutex-serialized
observed-call order. src/semantic_service_transport.rs owns the bounded
JSON-RPC-lines adapter over one retained semantic service. It admits a closed
nine-method lifecycle, wraps exact universal query, retained-index query,
history query, transaction, work, and
refresh artifacts, and accepts only caller-owned canonical manifest/source
bytes for refresh. src/cli/service.rs
authenticates one explicitly selected Project at startup and serves that
session on standard input/output. The transport is single-process and
single-client; it has no path selection after startup, socket, MCP/LSP,
watcher, durable store, concurrency, source write, execution, commit, or
publication authority. Frozen Project Agent Transport v5 and its
serve-workspace/MCP adapters remain separate. See Persistent Semantic
Workspace Service Transport v1.
src/semantic_service_mcp.rs owns the additive MCP stdio facade over that
retained service session. It admits only MCP initialize/initialized, ping,
one-page tool discovery, and seven closed tools for protocol, status, universal
query, retained-index query, history query, transaction validation, and
caller-owned refresh.
Tool results preserve the complete inner service response as bounded text.
src/cli/service.rs selects this facade only through the exact optional
--mcp suffix after the startup Project. MCP tools cannot select or reopen host
paths and add no authority. Frozen Project Agent Transport v5 and its distinct
MCP adapter are neither imported nor changed. See Persistent Semantic
Workspace Service MCP v1.
src/cli/query.rs and src/cli/change.rs own the read-only one-shot Universal
Semantic Workflow CLI v1 adapter. The Project-only query subcommands construct
one of the five canonical Universal Semantic Query operations and print its
exact result. change preview rename-display-name derives the current display
name from the same retained generation. The additive replace-expression form
selects a replaceable expression from that exact revision's authenticated
catalogue and derives its old source slice before constructing Universal
Semantic Transaction v2. Each route prints its exact core result or evidence.
Query and change routes run wholly within one with_authenticated_project lifetime, including
the final held-input recheck. They create no parallel schemas or semantic
implementation, do not retain the process-local service, and own no source,
cache, commit, managed-Workspace, transport, MCP, LSP, or publication authority.
Additive structural-diff, rebase, and explicit-order merge forms print the
exact Universal Semantic Transaction Composition v1 reports. Rebase retains
and finally rechecks both explicitly selected Projects; merge retains one
shared-base Project. These adapters add no automatic order, transaction-input,
source-commit, or publication path.
Frozen Project Agent Transport v5 remains unchanged. See Universal Semantic
Workflow CLI v1.
src/installed_guidance.rs owns Installed Agent Guidance v1. It packages six
closed, version-matched, authority-free skill documents from compiler-embedded
quick-reference, shape, standard-library, package, protocol, and effect facts.
The module also projects the exact five installed Universal Semantic Query v1
operations with no host grants. Canonical payload and independently identified
embedded-source bytes are digest-bound; compiler metadata explicitly declines
binary-identity attestation. src/cli/skills.rs and the capabilities branch in
src/cli/query.rs only select and print these exact core artifacts. They do not
read resource paths, discover a live service, execute guidance, grant host
capabilities, or modify the legacy source-query route. See Installed Agent
Guidance v1.
Root build.rs owns the closed build-time scan of Rust diagnostic code tokens
below src/ and workspace-member crates/, including the explicit inventory
of unresolved dynamic Diagnostic constructor sites. It writes only Cargo
OUT_DIR generated arrays. src/installed_diagnostics.rs embeds those arrays
and owns the bounded canonical Installed Diagnostic catalogue and per-code
explanation, compiler-version binding, domain-separated digests, and exact
explanation replay. src/cli/explain.rs is a one-shot selector and exact
text/JSON printer; it adds no catalogue CLI and does not reinterpret emitted
messages. Runtime construction reads no source path or current directory and
grants no filesystem, process, network, repair, transaction, or publication
authority. Static token coverage remains distinct from runtime reachability,
and unresolved dynamic sites remain visible rather than being inferred away.
See Installed Diagnostics v1.
src/installed_fix_plan.rs owns the authority-free Installed Fix Plan v1
catalog and exact current-source plan. The catalog advertises only the already
admitted SPX-S103 assign_function_id repair class. The current plan
delegates held-source authentication, eligibility, and final drift checking to
src/repair.rs, embeds its exact discovery report under a separate digest,
and never calls repair instantiation or patch application. src/cli/fix.rs
parses only the catalog and explicit-source --plan forms and prints exact
core bytes. These modules own no source write, persistent-ID selection,
candidate, patch, ranking, process, transport, or publication authority. See
Installed Fix Plan v1.
src/project/image.rs derives an immutable, bounded Semantic Workspace
Image from one already admitted Arc<ProjectRevision>. It retains validated
HIR in memory and projects the complete Project graph plus existing typed
stable-ID and adjacency indexes. Canonical .spx remains the Git authority;
image bytes are optional caller-persisted data, never trusted serialized HIR.
Replay freshly derives and exact-compares the complete canonical image before
returning it. Digest-bound symbol, Context, and Impact queries grant no file,
cache, execution, or commit authority. Compiler package version binding is not
a binary fingerprint. This foundation and its regressions are included in the v0.4.0 hosted-green regression corpus;
incremental rechecking, general graph mutation, and persistent daemon caches
remain outside it. See Semantic Workspace Image v1.
Source-owned static protocol conformance
src/static_protocol.rs checks persistent, source-owned static implementation
mappings from local protocol requirements to ordinary existing functions.
candidate/interface.rs derives eligible member discovery and admits a closed
implement_interface intention for the bounded monomorphic local-record slice.
Required members must be covered exactly and signatures must match; canonical
source is reparsed and complete Project admission runs before a candidate is
retained. These mappings do not introduce runtime witnesses, virtual calls,
dynamic dispatch or an unchecked graph-only implementation.
Static Protocol Conformance v1 and
Interface Change v1 own the exact subset.
Image Protocol Conformance v1 carries
source-bound conformance as a separate derived projection and exposes additive
v4 protocol/conformance and candidate/interface-catalog queries. The runtime
Graph and earlier protocol method sets retain their existing contracts. Discovery
facts grant neither execution nor publication authority. These authored slices
bring all eleven requested operation classes into bounded scope; they do not
complete general interface semantics or the graph-operational programme, and
the admitted implementation has HOSTED GREEN v0.4.0 regression evidence.
Unified workspace session v5
project/candidate/archive.rs packages canonical original source/manifest and
the existing complete-history recovery capsule into an independently replayed
archive. candidate_archive_store owns a separate explicit immutable file store:
private host root, held no-follow directory chain, bounded exact inventory,
exclusive create-new stage and no-replace pivot. Load recompiles archived source
and history under the held store input; no serialized HIR is trusted and raw
source is not reconstructed on disk. Post-pivot uncertainty never regains
cleanup or retry authority. This is candidate persistence, not warm HIR reuse.
The same store now has typed draft persistence/load entry points over a private
shared byte-transport seam. Draft source/history/selector replay runs before
root opening on persist and inside the held-input scope on load. Both archive
kinds share the fixed inventory but retain separate schema admission. CLI
draft_archive.rs and host-policy v6 add explicit draft storage and startup
selection; neither path restores approvals or opens a new request authority.
See Typed-draft persistence.
image_transport/vnext/recovery.rs admits independently recovered candidates
only through startup host APIs, under live snapshot authentication and ordinary
registry bounds. Canonical manifest equality permits historical source revisions
without making them current. CLI host-policy v3 supplies at most sixteen explicit
store selections; earlier policy versions stay closed. Git authority opens only
after these loads and remains separately approved. Candidate Archive,
Archive Store, Recovery
and CLI own release-tested cases and exact bounds.
image_transport/vnext.rs composes a fixed host-selected policy over the
existing candidate engine. Read-only access, candidate preparation, diagnostic
attempts, fixed-policy interpreter tests and pathless carrier builds have
distinct grants; disabled operations are absent from discovery. V1–v4 method
sets and byte contracts remain separate. workspace/refresh-preview observes the
new source revision without swapping state. workspace/refresh loads only the
fixed manifest and checks exact expected revisions before swapping the retained
snapshot/image. Immutable historical candidate handles survive; drafts and
attempts are cleared on success. The default constructor uses cold source
recovery; the explicit cache constructors below select reuse strategies.
image_transport/vnext/test_tasks.rs owns the one-task session registry and its
queued/running/terminal lifecycle. It detaches one immutable exact candidate and
fixed host test policy into a named scheduling worker, while the coordinator
retains every source-authentication and result-release decision. The project candidate layer
shares replay/report rendering between synchronous and cancellable execution;
a fixed-stack prepared evaluator thread supplies the monotonic step-boundary
cancellation flag. A process-wide eight-task permit bounds the scheduling and
evaluator thread pairs across sessions.
Drift, successful refresh, finish, and drop cancel and join before a late report
can escape. Candidate Test Tasks v1 owns the
wire shapes, race semantics, authority ledger, and bounds.
The optional image_transport/vnext/mcp.rs adapter consumes a configured v5
session. Its pinned MCP lifecycle and stdio framing delegate semantic calls
to the ordinary v5 handler, preserving source and publication boundaries.
mcp_catalog.rs derives a collision-checked tool mapping and local-reference
input schemas from selected methods. Response capacity is reserved before
forwarding calls so wrapper escaping cannot hide a completed mutation or
publication. The CLI shares workspace_session startup policy loading between
ordinary NDJSON and serve-workspace-mcp; no client capability becomes authority.
Selected candidate-test task methods remain ordinary MCP tools; the adapter does
not advertise the optional MCP Tasks facility or map notifications/cancelled.
See MCP Adapter for bounds and evidence limits.
Discovery's clients.rs retains selected-method request generation and runtime
validation. Its bounded response normalizer lifts only document-local definitions
from reachable schemas into an internal absolute-reference registry and retains
all supported assertions. repair_schemas.rs composes the closed repair report
from the existing constructor owner, restricted to actual body repair forms.
response_types.rs builds a shared bounded response-type model with guarded
recursion from the already audited reachable payload schemas; response_types_rust.rs and
response_types_script.rs emit concrete Rust, TypeScript and Python shapes.
Additive typed decoders enter through validators whose work budget is shared
across recursive references and failed alternative trials. Constant discriminants
are checked before recursive fields. Unbundled reports
remain opaque, and no generated helper owns transport or publication authority.
See Typed Response Clients.
request_types.rs separately models selected complete request shapes, retaining
document-local reference scopes and admitting recursive constructor shapes.
Its Rust and script emitters supply additive typed request builders through the
existing outer validator. They do not add nested runtime validation, semantic
admission, transport or publication authority. See
Typed Request Clients.
project/candidate/draft_navigation.rs derives compact hole summaries and
bounded facet pages from the existing exact full context. Opaque references bind
the draft, hole, context bytes and selected facet; they grant no authority.
The v5 hole_navigation.rs adapter exposes these pure projections through
ordinary live-source authentication and detached reads. Full contract, loan and
cleanup contexts retain their existing owners and bytes. See
Compact Hole Navigation.
project/candidate/draft_suggestions.rs derives bounded place and direct-call
proposals from the existing exact hole context, then invokes ordinary fill on
the original draft for each attempt. Type/effect matching prunes enumeration;
full source admission owns ownership, loan, cleanup and profile checks. Preview
drafts are dropped, and their digests confer no registry handle. The v5
hole_suggestions.rs adapter and detached reads share the pure query; its
finite output grammar is derived from compiler constructor schemas. See
Fill Suggestions for search, replay and
report bounds and the distinction between source admission and intended behavior.
project/candidate/draft_expression_catalog.rs reuses the private last-valid
candidate's checked expression catalogue and wraps it with exact draft and
region bindings. The separate last-valid digest fields are descriptive; this
query releases no candidate, source or publication handle. V5 and detached
reads share the projection, and the editor uses it for further hole selection
after fills. See Draft Expression Catalogue.
project/candidate/source_review.rs independently replays candidate history and
derives a closed source-pair/diff report, lazily retained on that exact candidate.
The v5 source_review.rs adapter shares its immutable bytes across bounded
chunks and detached reads; held-source authentication remains in the coordinator.
editors/vscode supplies an optional explicit-start MCP client and read-only
virtual diff documents. Its general command allowlist excludes build and source
publication; the separate candidate-test task controller consumes only the four
task methods when they already exist in the startup-selected server catalogue.
Editor
events invalidate UI state but never authorize or replace source authentication.
See Source Review and
Saved-Source Editor.
editors/vscode/holes.js coordinates an editor-owned typed draft through the
existing body, expression and contract-hole routes. It validates bound handles
and compact navigation, preserves failed fills, retires superseded draft
handles and requires explicit completion before candidate review. Editor
scratch bindings and source epochs are local freshness checks, not semantic
proof or publication authority; compiler admission remains unchanged.
Checked fill suggestions bind a closed bounded report to the controller's own
current summary. The extension requires an explicit choice before copying only
its expression into ordinary bound scratch; preview digests are never adopted.
Epoch and selection checks surround each asynchronous UI step, and actual fill
remains a separate compiler-validated request.
editors/vscode/repairs.js retains rejected attempts separately from the valid
candidate, verifies exact raw diagnostic report bytes and binds compiler repair
catalogues to the predecessor. Explicit selection sends only attempt and repair
IDs; displayed change bodies never become requests. The controller retires old
attempt handles after validated transitions and fails closed on uncertainty.
Diagnostic locations remain descriptive, with no source navigation authority.
An opt-in open_with_frontend_cache constructor uses the same authenticated
filesystem loader with ProjectFrontendCache as its build strategy. It parses
fresh source directly on first load, then stages exact-source AST reuse during
refresh/preview while rebuilding all checked semantics. Only successful explicit
refresh installs the staged cache alongside the new snapshot/image. Host-policy
v2 selects this strategy through a required boolean; v1 stays closed and cold.
The optional work report records actual frontend calls, not elapsed speed.
open_with_semantic_cache additionally retains compiler-created checked module
HIR against exact synthetic AST inputs, including imported declaration stubs.
Host-policy v4 selects this strategy explicitly. Source authentication, HIR
validation, cross-file checks, linking and profile admission remain mandatory;
only eligible resolver work is reused. The cache shares the existing staged
refresh/preview lifecycle and grants no publication authority.
semantic_cache_store.rs and its Unix host module own a separate keyed cache
root, exact compiler-file binding and immutable publication. They authenticate
the complete envelope before the private cache_codec and hir/cache_codec
construct cached AST/HIR. project/incremental/snapshot.rs reparses canonical
sources, requires exact synthetic-input reuse, and repeats complete Project
admission and graph comparison before returning an opaque cache. HIR validation
alone does not prove source correspondence: the host must protect the signing
key and keep its static compiler installation immutable from exec. Host-policy
v5 can select one entry before live source authentication; no RPC gains storage
or signing authority. Existing source-backed Image/Revision stores stay cold.
semantic-cache-lifecycle composes the existing host-selected cache operations
with authenticated v5 opens and same-revision refresh into one deterministic
compiler-work receipt. It records cold, authenticated restored, refreshed,
evicted and cold-rebuilt stages plus exact retained byte counts and semantic
identity equality. It is an explicit CLI storage effect against an existing
empty private root; it neither changes canonical source nor supplies wall-time,
RSS, cross-process, target-execution or publication evidence.
image_transport/vnext/read_batch.rs adds an embedding-host batch API for up to
sixteen selected immutable semantic requests on at most four scoped workers.
Source authentication surrounds the complete joined batch, and rows remain in
input order. Workers receive no registry, snapshot handles, cache, Git host or
test interpreter. Retained reads resolve only request-selected candidate, draft
and attempt references inside authentication, then share pure payload handlers
with sequential dispatch. Diagnostic inventory reads detach a bounded immutable
attempt-reference inventory and retain ordinary matching/error order.
Policy-bearing discovery values are prepared by the serial coordinator inside
authentication, so workers receive no execution policy. Refresh, registry mutations, runtime
tests, builds and publication are excluded. read_batch_rpc.rs adds only an
explicit startup-selected workspace/read-batch entry point over that same
worker engine. Host-policy v7 configures a fixed worker count independently of
other grants; MCP and generated discovery derive the selected method. The
complete outer response is bounded before final source authentication, including
all-error batches, and keeps the existing 1 MiB cap. The CLI NDJSON loop remains
sequential across outer requests. See Parallel Read Protocol,
Frontend Cache and
Parallel Reads and
Parallel Retained Reads for bounds and release regression evidence.
image_transport/vnext/commit.rs holds separately supplied fixed Git authority
and a startup-only private approval slot. A request cannot choose its repository,
ref, old commit, metadata or approval. A review/export session precedes a new
host-approved commit session that restores the exact candidate. Publication
runs after the initial held-input selection boundary; the Git library owns its
fresh replay, ref pivot and post-pivot uncertainty classification. Compact
receipt handles prevent escaped receipt overflow after a pivot. The original
raw checkout remains unchanged, and consumed or terminal approval is not
refreshed by a source reload. Provider deadlines are never silently reset.
project/image_targets.rs and the v5 projection adapter derive actual target
emission facts and replay existing pathless Web/npm carriers. Declared export
and input relationships do not imply runtime coverage or external consumer use.
candidate/build needs a host grant, independently restores candidate history,
and returns bounded report chunks; it does not publish filesystem artifacts,
install packages, invoke a native toolchain or execute generated code.
project/image_coverage.rs inventories exact retained source/manifest bindings
and interface-import declarations, and explicitly reports deployment,
generated provenance, external behavior, runtime and consumer analysis gaps.
Its closed blind_spots ledger binds absent deployment-configuration,
generated-file-provenance and external-API/deployed-runtime evidence to the
exact retained Project/source inventory while explicitly refusing to infer
that the corresponding contract is absent.
The v5 image/analysis-coverage read shares ordinary source authentication and
the detached parallel read path. It neither scans external inputs nor mistakes
missing edges for absent external systems. See
Analysis Coverage.
candidate/deployment_contract_evidence.rs can attach a canonical value-free
configuration declaration to one exact candidate and its complete explicit
manifest-export inventory. It accepts only sorted key/type/required shapes and
changes the deployment row to partial; it never reads environment values,
secrets, paths, URLs or provider locators and does not verify or perform a
deployment. The candidate-only v5 adapter exposes the same pure derivation as a
bounded chunked read and generates its client/MCP surface from the selected
catalogue; declaration bytes remain request data rather than a path or grant.
The v5 discovery catalogue generates its granted methods, schemas, instructions and typed client helpers together. Opaque nested payload references remain explicitly incomplete; a generated bundle is not a complete executable response validator. Agent Discovery v5 owns the exact request/envelope schemas, concrete transport payloads and explicitly unbundled compiler-report schemas; generated clients perform no I/O or execution. See Workspace Protocol v5, Source Commit v5, Target/Artifact Projections, and Workspace Session CLI. All evidence for this batch is included in the v0.4.0 hosted-green regression corpus; no complete-workflow or current-head promotion follows.
Project profile and daemon
project/incremental.rs owns an opt-in, invocation-local cache of exact-source
canonical ASTs. It can avoid parsing/canonicalization for eligible retained
modules while the ordinary graph, linking and profile gates still revalidate
semantics. Its separate semantic-cache constructor also retains exact synthetic
AST/HIR pairs and conservative reverse-import invalidation. Complete module
hits replay checked-HIR validation and preserve cold builder accounting without
calling the source resolver again. A changed module can reuse exact monomorphic
free-function HIR only under complete non-body environment, signature,
contract, span and selected-AST equality; source verification, declaration
reconstruction, HIR validation and every Project-wide gate still rerun. Only
the separately authenticated snapshot loader can
restore serialized HIR into this cache. candidate/draft.rs now carries
disjoint expression holes as well as whole-body holes; completed fills pass
ordinary candidate admission and reauthenticate surviving selections against
the resulting canonical source. Neither cache nor draft owns source authority.
project/image_reference.rs exports exact image-bound stable function/facet
selectors and resolves them only through ordinary admitted image provenance.
Its conservative cross-revision rebind authenticates both images and the source
selector, then requires one unique explicit identity and exact source/module
facts before exporting a fresh destination selector. Provenance classification
does not infer revision ancestry, semantic equivalence or compatibility.
project/target_cache.rs owns separate caller-scoped exact scalar-Web,
pathless native-C11 and pathless npm target entries. Their keys bind the admitted immutable
Project/workspace/graph identities, canonical manifest, target selectors,
compiler compatibility and byte bound. Every hit independently verifies its
retained carrier; the C lane replays artifact and embedded header-envelope
bindings, while npm replays its closed semantic recipe and ordered file bytes.
Reuse skips only target emission and grants no persistence, filesystem,
package-manager, compilation, execution or publication
authority. See Project Target Cache v1.
src/semantic_retention.rs owns a pure bounded metadata policy for exact image,
candidate and draft identities. It derives canonical chained checkpoints and
separately digest-bound GC plans from caller-supplied inventories. Recovery
authenticates predecessor and policy bytes and returns
RetentionAuthority::None; the module never reads storage, deletes an object,
establishes freshness, restores approval, or publishes a generation.
project/image_store.rs and candidate_archive_store.rs translate only
successful image/candidate/draft publication receipts into that inventory.
Those receipts retain exact logical byte counts and identities but no path or
store handle; heterogeneous planning still performs no discovery, checkpoint
persistence, deletion, replay, approval or publication.
src/semantic_retention_store.rs separately persists one already authenticated
checkpoint/plan pair as a fixed immutable envelope through a single no-replace
Unix pivot. Held private root/file identities and independently supplied
checkpoint/predecessor/plan selectors guard ordinary restoration. This store
persists metadata only: it cannot apply the plan, enumerate/delete subjects,
infer newest state or restore any source/image/candidate authority.
src/semantic_retention_registry.rs composes successful typed receipts, the
pure planner and that unchanged pair store behind a separate explicit private
registry root. A held 0700 metadata child owns immutable pairs; a canonical
0600 CURRENT cursor binds the consecutive sequence, exact pair selectors and
fixed policy. Pair operations stay descriptor-relative to that held child.
Initialization and CAS advancement settle the pair before the cursor pivot.
Recovery authenticates only the pair named by CURRENT; exact pre-pivot pairs
may be reused after rederivation, while post-pivot uncertainty requires recovery
from the same explicit root. An interrupted cursor stage must be canonical,
backed by its exact held-directory pair and consecutive with CURRENT before
exclusive cleanup; malformed or unrelated stages fail closed. Cursor-stage
cleanup never deletes a retained subject or immutable pair. The registry grants
no source, subject-store, GC, approval or publication authority and has no CLI
or session integration. See Semantic Retention Registry v1.
src/semantic_retention_lifecycle/automatic.rs composes one separately held
candidate/draft archive store with that registry. Immutable archive publication
precedes checkpointing. A fresh coordinator can replay an exact already stored
archive into a typed receipt, then either recognize its exact retained subject
or attempt one registry checkpoint, closing the crash window without weakening
ordinary no-adoption publication. Its canonical replay and resume reports are
accountability data only; current source, Git, approval, GC, warm HIR and
publication authority remain outside the module. See Automatic durable
candidate/draft lifecycle v1.
src/cli/retention_metadata.rs is the narrow command-line adapter. It receives
an explicit bounded canonical declaration inventory whose rows contain only a
closed image/candidate/draft subject and byte accounting. Declaration rows use
visible canonical subject-JSON order; compiler code derives their subject
digests and emits the exact digest-ordered observation inventory consumed by
planning. No caller-supplied subject digest is trusted. The adapter then
receives an explicit bounded canonical observation-inventory file and optional exact
prior-checkpoint file/digest/predecessor tuple for authority-neutral planning.
Planning returns canonical checkpoint and GC-plan metadata without reading a
store or persisting or applying either value. The same adapter receives an
explicit existing store root, explicit bounded checkpoint/plan files for
publication and all exact selectors as positional operands. Load requires the
same selector tuple and returns the authenticated canonical metadata only. The
adapter introduces no receipt trust, inventory or root discovery, freshness
selection, GC execution, subject restoration, approval or publication path. See
Semantic Retention Metadata CLI v1.
candidate/git_publication.rs authenticates Git object identities and original
Project source before constructing canonical replacement blobs, trees and a
commit. Its explicit host authority owns one expected-old Git ref update. The
Unix process adapter selects a bounded bare SHA1 or SHA256 repository,
executable and lease. It launches from held executable and repository handles,
gives the child only its exact standard-pipe descriptor inventory and a fixed
safety environment with no inherited entries, and settles the owned process
group before ordinary return.
Linux uses descriptor execution and handle-relative cwd selection; macOS derives
a path from the held executable, starts suspended, and attests executable-vnode
and cwd identity before resume, failing closed on disagreement. The
adapter disables inherited config, hooks and Git transports and never rewrites
a checkout. Target OID width must match the held repository format.
SHA1 is legacy Git compatibility: exact original-source comparisons, staged-object
readback and an independent SHA256 content binding do not constitute SHA1
collision detection or a signature. The trusted host owns the executable and
repository. Held execution closes the same-byte pathname-substitution gap, but
the cooperative lease and object scan do not make a same-UID writer to the
repository's contents trustworthy or form an OS network sandbox.
This authority remains separate from managed Workspace ACTIVE and ordinary
image/candidate reasoning. V5 can hold it only through an explicit startup host
extension with independently supplied exact candidate approval. candidate/diagnostic_intent.rs rederives a selected repair
from a fresh rejected attempt before ordinary candidate admission records its
typed history; no invalid image or submitted replacement becomes trusted state.
src/project/image_store.rs binds semantic image receipts to secure persisted
Project source inputs. Loading rebuilds and re-derives the image. The separate
ImageWorkspace::with_semantic_cache opt-in uses checked-module reuse for
owned-source refresh; cold and AST-only constructors retain their behavior.
Those source-backed image-store routes do not restore serialized HIR.
candidate/delta.rs derives source-bound before/after
semantic facts with exact replay. Diagnostic protocol v4 retains bounded rejected
attempts and verified repair proposals, with test authority selected only by the
host. Store and managed publication remain separate from protocol authority.
candidate/interface_delta.rs separately compares complete source-owned protocol
and implementation inventories, actual member-function facts and static call
dependencies. Verification replays the candidate before recomputing the report;
no runtime dispatch facts or graph authority are introduced. V5's
review_facets.rs exposes the candidate-bound chunk query. Its sibling
symbol_diagnostics.rs joins only retained attempts whose predecessor and intent
target match exactly, derives available repairs through ordinary candidate
admission, and binds chunk continuations to the exact report digest. Rejected
attempts never become checked images or trusted source spans.
candidate/contract_delta.rs separately compares whole-candidate ordered
predicates and their static callable dependencies. It derives checked predicate
projections and source-backed dependency facts, then independently replays the
candidate before verifying exact report bytes. V5 exposes a candidate-granted
chunk query; this read performs no target generation or execution and adds no
publication authority.
candidate/ownership_delta.rs compares exact checked source-nominal shapes and
supported monomorphic aggregate type facts together with source-function and
retained-instance ownership facts, complete structural inventories, and the
existing ordered loan/cleanup projections. Generic type facts remain explicitly unavailable;
layout keys are compiler facts rather than ABI judgments. Exact report
verification replays the full candidate first. The report neither changes a
plan nor turns its actions into physical ownership authority; v5 exposes it
through candidate-granted chunks.
candidate/artifact_delta.rs replays the full candidate before comparing base
and candidate Web/npm carriers through existing independently verified pathless
artifact projections. File-content, stable export, source and carrier bindings
remain distinct. V5 requires the existing build grant and provides report chunks;
neither report generation nor verification installs or publishes artifacts.
project/image_targets/openapi.rs extends this pathless review lane with actual
per-source OpenAPI envelopes. The shared openapi.rs renderer preserves its
scalar admission rules; the Project carrier rebuilds every canonical input and
regenerates the artifacts before exact replay. Source-selected stable IDs bind
documents to exports, while image summaries and candidate deltas retain their
existing authority boundaries. See OpenAPI Artifacts.
Its project/image_targets/c.rs sibling binds the actual checked native C11
entry projection to source-selected C headers through the existing renderer's
prototype extraction, admission and hygiene rules. The carrier rebuilds all
canonical Project inputs and regenerates every file before exact comparison.
Explicit header exclusions do not create ABI symbols; static linkage and
context/status conventions remain unchanged. See C Artifacts.
The integrated workflow is release-tested and publishes managed generations only; canonical Git files stay unchanged.
src/project/candidate/ owns immutable source-derived candidate overlays and
closed typed intentions. The engine mutates invocation-local ASTs; canonical
source then re-enters complete Project admission and a second source replay.
Candidates retain reviewable replacements/diffs and target projection facts,
never filesystem or publication authority. src/project/image_facets.rs
projects actual retained HIR into revision-bound paginated facets without
changing the original image wire. Its image_facets/instances.rs child adds
source-template selection and concrete retained-instance pages. It reuses the
seven applicable facet renderers and separately joins exact instance callers
and linked-closure membership, because an instance's internal function ID
still names its template. It creates no new instantiation or execution.
src/image_transport.rs exposes these
queries through a separately selected read-only protocol whose one method
catalog also generates discovery/schema/client material. Existing transports
keep their method sets. See Candidates,
facets, and
Image Agent Protocol.
src/project/image_dependencies.rs owns a lazy bounded dependency index retained
by each immutable image. Candidate delta relationships and the read-only v5
image/dependencies query share its source-HIR collector. Source-bound access
sites and direct caller closure are structural facts, not runtime or coverage
evidence. Initialization, including failure, is shared across immutable reads;
no index is serialized into Image v1 or given publication authority. See
Declaration Dependencies.
Its image_dependencies/navigation.rs child exposes compact summaries and
opaque-reference detail pages over the same retained index. Selection works on
IDs and row ordinals; only requested page rows are projected. It adds no HIR
walker, mutable cursor registry or source authority. See
Dependency Navigation.
Its image_dependencies/obligations.rs child lazily indexes retained cleanup
and loan proof facts by their actual type/case/field identities. Storage shapes
and exact projection paths select original plan coordinates without another
expression-reference scan or changes to plan vectors. The cache stays outside
Image v1 serialization; image verification recomputes it from retained checked
HIR. candidate/cleanup_dependencies.rs reuses the collector for target-specific
before/after review, with complete source-history replay on verification. V5
keeps the image query read-only and the candidate query behind its existing
candidate grant. See Cleanup Dependencies.
The additive candidate-only protocol selects
ephemeral candidate/draft registry authority at host startup; it cannot grant
source writes, runtime tests or builds. Responses are bounded and held source
inputs are reauthenticated before registry mutations become visible. Typed
body-hole drafts expose context while blocking
materialization until all holes are filled through full candidate admission.
Ordered signature mapping stages every
original argument once, left-to-right, before retaining, reordering or removing
Copy parameters; admitted byte, String and resource-free nominal owners must
all be retained once. Source String parameters resolve to owning HIR even
without an explicit source own modifier.
An additive borrowed-alias form accepts only an original borrow str or
borrow Slice<u8> parameter that remains exactly once. It derives the new
parameter type/root from checked HIR and reuses the original staged view;
ordinary post-rebuild loan and provenance validation rejects any unsafe alias.
candidate/signature_arguments.rs constructs explicit computed-argument
templates against each caller's bindings and reuses scope-aware substitution
to select staged original values. The signature engine appends typed computed
locals after all original stages; full candidate replay owns semantic admission.
Computed nominal types reuse stable-ID type planning separately for the provider
and each caller annotation. After source rebuild, an additional signature gate
checks exact owner/argument identities and retained Sized Copy, resource-free,
no-drop facts before exposing a candidate, including signatures without calls.
Expression-template preflight without callers is structural only. See
Argument Expressions.
Workspace module projections privately retain compiler-checked nominal
parameter and return TypeFacts, including types outside entry/test reachability. The
candidate admission and catalogue share those exact facts for concrete Copy
record/variant eligibility and resource-free owning record/variant eligibility;
they do not infer ownership from source spelling. Primitive String eligibility
uses the checked parameter mode and ordinary compiler TypeFacts.
These facts add no graph wire fields or source authority. These additions are
included in the v0.4.0 hosted-green regression corpus.
candidate/expression.rs joins retained HIR identities to canonical AST
provenance for typed body-expression replacement, preserving the selected
expression's expected type through complete Project rebuilding. Contract
insertion permits exactly one additional predicate while retaining prior
contracts and all other invariant inventories. candidate/rebase.rs compares
stable-ID target/dependency facts, normalizes call display names for conflict
selection, binds nominal signatures to retained checked type identities, and
replays supported intentions over an admitted base. Same-root
merge retains both histories and the original source-diff base. These APIs
produce candidates and ancestry reports, never source publication authority.
candidate/merge_preview.rs reuses the ordinary merge implementation in both
orders and compares exact accepted manifest/source bytes. It returns only bound
directional facts or bounded diagnostic excerpts, never either temporary
candidate. The v5 adapter uses the same detached two-candidate read subjects in
sequential and parallel paths; no registry mutation or publication host enters
the preview. See Merge Preview.
candidate/rebase_normalize.rs borrows the existing Operations AST/HIR
occurrence collector through a private Project view. It derives bounded,
collision-checked identity markers for nominal and member references in
comparison-only source copies, retaining checked owner shapes and ancestry.
Canonical formatting of those parse-only copies removes display-name noise
without changing binders, expression order or actual source. Candidate and
draft dependency comparisons normalize only known descriptor display fields;
ordinary source replay and publication boundaries remain unchanged.
The additive contract-expression route in candidate/expression.rs reuses exact
HIR/AST joins for existing pre/postcondition subtrees while leaving body-only
APIs unchanged. Its post-admission gate reconstructs the complete requested
canonical source and checks phase/path/type/ownership again. candidate/draft.rs
keeps contract holes separate from body regions under one shared budget and
remaps survivors after fills; draft recovery stores only selectors over replayed
valid history. V5 adds candidate-granted discovery and hole opening, with no
build or publication authority. See
Contract Expression Holes.
candidate/builtin.rs, a child of the intent module, resolves typed
builtin_call requests through the compiler-owned byte and string operation inventories.
It rejects source identity/binding collisions and supplies the same descriptors
to discovery and semantic rebase. Its shared operation selector also supplies
the exact HIR occurrence map used by declaration movement, without broadening
movement's checked type or import vocabulary. Ordinary source-call lowering and complete
candidate replay retain ownership, view provenance, cleanup and target
authority; the graph carries no new independent meaning. See
Builtin Call Constructor.
candidate/aggregate.rs resolves typed record/case/field constructors through
retained checked module declarations and existing local/imported type bindings.
The revision-aware expression constructor shares this path across bodies,
expressions, contracts, declarations and hole fills. It preserves requested
initializer order and delegates all semantic admission to the ordinary complete
candidate rebuild. Discovery projects the same checked inventory; rebase binds
referenced aggregate shapes for each original/rebased intermediate revision.
No source spelling or new import authority comes from constructor requests.
Generic construction retains checked template parameter identities and emits
explicit direct-scalar type arguments through the same AST path. The separate
prelude selection authenticates the fixed compiler-owned Option/Result
declaration inventory against retained HIR; it does not relax authored explicit
identity checks. Discovery reports templates and compiler provenance rather
than claiming concrete instantiation admission.
Record-field value projection uses the same checked owner inventory and emits
a hygienic typed local followed by the ordinary field AST. The annotation
forces nominal owner equality through existing source admission, and the base
is evaluated once under normal value-binding ownership/cleanup rules. Rebase
binds the selected field and complete owner descriptor before replay; discovery
does not treat field spelling or a matching result type as owner evidence.
Direct field_place construction instead authenticates the lexical root's
nominal type against the selected stable field owner and emits an ordinary
field expression without a temporary. The intent child candidate/field_place.rs
owns bounded nominal fact propagation. Constructor scope facts come from
authenticated parameters, selected HIR scope and bounded propagation through
typed constructors; they do not replace the source verifier's loan, move or
cleanup checks. Discovery distinguishes direct places from value projections,
and rebase retains the complete selected-owner dependency. See
Field Place Constructor.
candidate/aggregate_match.rs derives whole-variant matching plans and
discovery from the same checked source/prelude identities. The expression
constructor stages the exact nominal scrutinee once and emits ordinary
exhaustive value-match patterns with arm-local payload bindings. Rebase binds
the complete case and payload inventory; ordinary candidate source admission
retains all matching, ownership, cleanup and target checks.
Record updates reuse candidate/aggregate.rs owner/member resolution and lower
to the existing update AST after exact-owner staging. The base is evaluated
once before requested replacements, with untouched fields left to ordinary
update semantics. Discovery exposes the complete owner inventory and rebase
binds that inventory even for fields omitted from the replacement subset.
candidate/declaration.rs appends a typed function under a selected module
anchor with globally fresh identity and checked namespace/effect budgets.
candidate/type_declaration.rs appends explicit monomorphic record/variant
declarations with bounded direct data fields or authenticated existing nominal
selectors under the same function-anchor rule. Field selection reuses the
compiler's stable-ID binding planner; full rebuilding owns data-type admission.
Its complete planned owner/case/field inventory is the only allowed graph
identity extension; exact source reconstruction follows full Project replay.
Rebase checks collisions for all new member IDs, binds nominal field dependencies
through the shared recursive intention walk, and preserves history order
when a later operation evolves or uses the new type.
candidate/type_rename.rs delegates source record/variant display changes to a
private owned-source entry point in semantic_workspace_operations, reusing
the shared workspace_graph/operation_sidecar.rs AST/HIR occurrence collector,
namespace checks and exact normalized replay. The Candidate route reparses the
result, performs ordinary full Project replay and checks its exact source plan.
No new reference index, managed lock or publication authority is introduced;
the public Operations proposal retains its multi-operation minima. Nominal
rebase uses separate source shape/origin/binding facts and test planning falls
back conservatively for non-callable type changes. See
Nominal Rename.
The same adapter and private planner also select explicit source record fields, variant cases and payload fields. Member sidecar facts bind parent namespaces and cross-file occurrence paths so constructor, pattern and projection labels are migrated in consumers while type aliases stay unchanged. Member rebase binds the complete owner shape and test planning uses a non-callable fallback; no new public Operations subject or publication route is exposed. See Member Rename.
candidate/aggregate_nominal.rs authenticates existing record/variant type
selectors and visible bindings, including direct-scalar generic instances and
the fixed compiler prelude. Selection and catalogue templates are provisional;
after rebuilding, every function addition passes declaration.rs's checked
signature gate. Value nominal parameters require sized Copy/no-drop facts;
explicit owning nominal parameters require sized non-Copy/drop facts. Both
exclude resources, as do nominal results. Bare String parameters retain their
implicit checked ownership. Owning nominal preflight uses the existing bounded
selected-declaration type-facts helper; source/import/target admission is
unchanged. Signature and checked
body-value facts share the existing 4,096-entry per-module table and builder-byte
budget. Rebase binds complete selected type inventories before each replay.
candidate/extraction.rs derives immutable scalar or Sized Copy nominal captures
from actual HIR ValueIds, captures complete immutable roots for field reads,
and replaces an authenticated expression in place, rejecting unsafe
boundary relocation. Only the exact declared identity may extend invariant
inventories. Rebase tracks newly introduced identities and rejects collisions.
Checked expression/local/pattern types use retained compiler TypeFacts; nominal
helper signatures use exact stable-ID type planning and the existing post-rebuild
signature gate. A separate nested-block lane retains internal resource-free
owners while keeping captures Copy. It may return one whole checked
resource-free owner through the ordinary provisional-result commit. A distinct
owning-capture lane authenticates one
exact whole body-local Bytes/String owner with one unconditional consuming use,
then transfers it through an owning helper parameter at the original expression
position; parameters, projections, shared/borrowed roots, repeated or
conditional use and external consumers remain closed. The nested-block lane wraps the original
nested block in an empty helper root, preserving lexical cleanup before the
caller resumes and rejecting root-body relocation with owned data. Source/HIR
correspondence in candidate/extraction_owned.rs authenticates local values
and stable semantic identities; no
canonical ownership plan is rewritten. Retention keeps its declaration cap and charges bounded traversal
storage. Budget-report changes may change derived graph/image digests without
changing canonical source meaning or granting cache authority.
candidate/recovery.rs exports disposable complete histories and restores them
only by replaying against an independently admitted exact source base. It
imports neither serialized HIR nor authority and cannot materialize unresolved
drafts. candidate/draft_recovery.rs wraps that valid history with bounded
pending selectors, independently restores the history, and re-creates holes
through ordinary draft APIs before comparing exact draft/capsule identities.
Lineage-bearing v2 drafts additionally bind every successful fill to its exact
checked intention/history ordinal and retain bounded rebase/merge ancestry.
Recovery checks filled events against replayed history and preserves ancestry
as content-bound metadata; it does not prove the contents of parent drafts or
treat lineage as source meaning, approval, or authority. Lineage-free v1 draft and
recovery bytes remain preserved.
image_transport/vnext/draft_recovery.rs exposes host-selected chunk export and
transactional draft-only retention; it imports no registry or approval state.
candidate/draft_archive.rs composes that capsule with the existing complete
candidate source archive, so rebuilding an unfinished draft no longer requires
its original checkout. It compares the rebuilt last-valid candidate, pending
selectors and complete archive before returning only a draft. The v5
draft_archive.rs RPC module retains exact-current-base import; host methods in
vnext/recovery.rs separately allow same-manifest historical draft restore only
before the first frame. Both use ordinary authenticated registry admission and
recover no candidate entry or approval. See Draft Archive.
candidate/draft_rebase.rs rebases the private checked history through the
existing candidate owner, then uses shared semantic conflict fingerprints and
authenticated expression-origin remapping to reconstruct pending holes. The
v5 draft_rebase.rs adapter installs only the resulting draft after bounded
report preparation and live-source authentication; no candidate or publication
authority is released. See Draft Rebase.
Its private pending-rebinding helper is also used by candidate/draft_merge.rs
after one ordinary candidate history merge. Both parents pass region and
dependency checks; opposing history writes are checked before their pending
maps are reconciled through ordinary hole APIs. Final contexts precede result
publication. Filled events from both branches retain their actual merged
history ordinals, while ancestry records the two exact parent draft digests;
neither fact implicitly completes a pending sibling hole. The v5
draft_merge.rs adapter retains only the merged draft under
the same request/registry boundary. See Draft Merge.
These additions and focused regression cases are included in the v0.4.0 hosted-green regression corpus.
candidate/movement.rs moves eligible functions through stable-ID call/import
bindings. candidate/movement_types.rs checks retained resource-free nominal value facts,
plans authenticated type imports and remaps signature/local/aggregate/pattern
type syntax through destination bindings. Rebuilt type identities supplement
the existing call-inventory and exact source-reconstruction checks; source type
imports remain unchanged and ordinary Project admission still rejects cycles.
The movement planner retains exact checked builtin occurrences and reserves
their unchanged spellings during alias migration. Place roots, view operations,
type and ownership identities are compared after source rebuilding. Internal
owned byte work and String signatures add no staging or cleanup-plan edits;
explicit nongeneric resource-free record and variant type imports may carry
owned Bytes, while callable imports exposing owned nominal arguments remain
closed.
candidate/record_field.rs appends a typed scalar field and migrates
constructors and exact patterns using retained type identities and the owning
compiler type facts. hir/record_evolution.rs reconstructs only the bounded
selected declaration closure, including unused records, for the existing HIR
TypeFacts owner; it retains no additional whole-project index.
The operation admits existing checked sized resource-free records while
appending only inert non-droppable fields. Post-admission checks bind the old
field prefix and preserve the record's checked ownership flags; owning match bindings,
loan roots and cleanup order remain under normal source replay. Both reconstruct
the expected canonical source independently after admission; identity guards
permit only the planned function location or new record member. Rebase compares
record shape and relocation facts before full replay. No source authority is
added. image_facets/relationships.rs projects bounded data-access and audit
facts from retained HIR with source, expression and evidence provenance; the
existing Project admission remains responsible for excluding unsafe sources.
candidate/testing.rs derives test relevance from retained HIR and explicitly
executes the declared interpreter test closure only after exact candidate replay.
Image protocol v3 selects this bounded authority at host startup; policy cannot
be changed by requests. candidate/diagnostics.rs retains failed intentions and
diagnostics without exposing invalid source as a checked image, and routes its
bounded literal-retag and direct-field borrow repairs through ordinary complete
candidate admission. Its private candidate/diagnostic_borrow.rs helper requires
an actual SPX-T266 rejection
and only changes typed projections of named roots under byte-view constructors;
source ownership and loan validation remain the admission authority.
candidate/publication.rs is a separate host invocation over an existing managed
Workspace. Its in-memory Change-v1 seam acquires existing shared/exclusive
authority before candidate replay, authenticates Project and managed base sources,
and delegates the sole ACTIVE publication to the existing Workspace engine.
It grants neither a reusable authority token nor raw Git-source writes.
src/project/manifest.rs parses the bounded semaprax.toml profiles; its
tables submodule parses the extensible semaprax.manifest.v1 table layout
and lowers it onto the same frozen profile contracts.
src/project/external_dependencies.rs replays the exact held Subject-v3
inventory, proves that it is precisely the per-target selected closure, and
lends only embedded canonical source to the linker. Rust dependencies remain
outside that workspace and are rendered only into the authenticated generated
SDK Cargo package.
src/project/ owns held input authority, immutable revisions, semantic
admission, linking, execution, builds, npm carriers, rename planning, and the
unpublished native Rust SDK bridge.
src/project/admission/ is the sole exhaustive, authority-neutral Phase-A
profile dispatcher. It consumes the already linked entry HIR and exact retained
Project subject, runs the unchanged schema-selected target admission, and
retains v8/v9/v10 descriptors only as sealed compiler state. A prepared value
is neither evidence nor effect authority, and later public consumers still
replay descriptor bytes against retained HIR. This closes the ordinary v9
Project route without modifying an earlier profile or target schema. See
Project Profile Admission v1.
The shared Unix npm publisher in src/project/npm/publication.rs writes through
held directories and compares the final reopened parent identity, not only its
canonical pathname, before reporting success. This detects same-path parent
replacement without cleanup or rollback; it is an observation, not atomic
publication. See Project Manifest v2 for the shared
boundary and implemented regression modules. Windows routes are unchanged.
Project v8 adds one closed owned-data-api.v1 route. src/project/public_api.rs
derives and independently replays the sole semantic API descriptor from the
authenticated linked-HIR subject. Authentic cross-replay regressions distinguish
its retained-signature checks from digest rejection; equal descriptors alone
do not prove function-body equivalence or source provenance.
src/project/std_collections.rs authenticates the sole empty-descriptor Project
v8 exception: the frozen std.collections manifest and exact eight transparent
Owned Bounded Vec wrappers. Lookalike manifests and sources fail before build;
ordinary Project v8 and table manifests retain their nonempty export rules.
src/project/cxx_owned_data.rs and its bounded renderer compose that same
replayed descriptor with the existing native provider into an authority-free,
pathless C11/C++17 package. The C++ wrapper owns one thread-bound invocation
context, copies owned results before exact handle settlement, and fails stop on
cleanup uncertainty. This is a Project-v8 library surface, not a target,
publisher, loader, package-manager integration, or support promotion.
src/project/npm/owned_data.rs and the
owned-data Wasm lowering consume that descriptor for the npm package. The
shared src/project/npm/owned_data_input_v8.js admits complete input tuples
before snapshot allocation, using captured brand/buffer intrinsics. Its
historical filename and helper bytes remain unchanged; v9/v10 explicitly
select the same admission without altering v8 JavaScript for that extension.
The subsequent shared owned npm invocation state
is composed by src/project/npm/owned_invocation.rs from small private arena,
instantiation, invocation, result and facade templates under
src/project/npm/owned_invocation/. It reserves busy before preflight,
rejects non-string export identities without caller-controlled coercion,
authenticates recoverable semantic failures by
exact local error identity, and makes post-entry uncertainty and caught reentry
absorbing poison. Arena imports and result publication observe that same state;
guarded settlement/scratch cleanup preserves the first thrown value, including
falsy values. This correction changes v8/v9/v10 runtime JavaScript and integrity
bindings, not descriptors, Wasm or host signatures. Its released regressions are HOSTED GREEN. The
private src/wasm/aggregate/owned_stack.rs derives selected call-path frame
extents from the shared HIR call index and actual lowering plans so raw outputs
cannot overlap deeper helper frames. Native owned handles pair all 4,096 slots
with nonreused atomic issuance serials within one linked provider runtime;
contexts remain thread-confined. These corrections have release-tested
evidence and do not promote any profile. The
reference-interpreter entry in src/interpreter.rs returns a normalized
scalar/owned/variant value and one explicit copy-out-and-settle boundary event;
it does not grant target or publication authority.
Immutable Project revisions and snapshots expose separate read-only descriptor accessors for the v8 owned-data, v9 flat-owned-record, and v10 owned-UTF8 profiles. Each accessor replays the sealed Phase-A descriptor against the retained linked HIR and exact Project subject; Transport v5 continues to call only the v8-specific accessor and is not widened. CLI success labels distinguish the newly reachable v9 npm and Rust products without changing target authority or promotion state.
The Rust target deliberately crosses a dependency-inverted trust boundary:
held Project v8 snapshot + validated linked HIR
|
canonical descriptor + semantic replay
|
root-owned native provider C emission
|
semaprax-native-rust-owned-data-package
| held compiler/archive tools
| deterministic safe/FFI package rendering
| no-clobber staged publication + held-stage verification
|
unpublished compiler-free Rust package
The root crate retains semantic authority and contains no new unsafe Rust. The lower package crate receives only the already replayed descriptor, selected stable IDs, provider bytes and their digests. It independently parses the closed descriptor, checks provider integrity and the compiler-declared textual descriptor binding, selects only the exact current host target, and owns external tool and filesystem effects. It has no HIR or code-generation authority and therefore does not independently authenticate provider semantics; the root compiler owns that replay-equal proof. Generated safe code forbids unsafe code; the private generated FFI sibling remains the quarantine for opaque provider handles. Neither layer transfers provider allocation into a host allocator.
The lower package's private build_script.rs renders both owned-data build
script families. It preserves target selection and validates the package path
before line-oriented Cargo output; path text cannot introduce CR/LF directives.
See the path boundary
for the intentional artifact change and implemented regression scope.
The generated owned-data Rust invocation guard proves whole-context settlement through the existing context-close ABI before any outward value or recoverable error. Inner owner guards settle before context closure, including on unwind. Only a proven-closed context may be reinitialized on the next invocation; uncertain settlement is fail-stop. This resets a private invocation counter, not the linked provider's nonreused handle serial. Unknown tags or forged inactive handles grant no payload-operation authority. The correction changes generated safe/private Rust and integrity bindings, not provider C/ABI or public types, and does not establish safety against arbitrary hostile native code. Initialization rejection retains its existing error with no further provider operation in that invocation or its cleanup. A later explicit invocation may attempt initialization again; only success creates the close obligation.
The oci build target (Project v1 scalar profile only) crosses a similar
dependency-inverted boundary, but its lower crate needs no privileged
toolchain, so it is a normal dependency of the root crate rather than a
PrivateHost-injected one:
held Project v1 snapshot + verified ProjectWebBuild envelope
|
src/project/oci.rs: envelope replay + field extraction
|
semaprax-oci-package: OciPlan
|
hostile-input admission + credential-environment refusal
|
deterministic OCI Image Layout (no base layer, unsigned, unpublished)
crates/semaprax-oci-package knows neither HIR nor Project manifests: it
receives only the already-verified Wasm bytes and identity strings, recomputes
and cross-checks their digests itself, and owns the local, no-clobber
filesystem publish. It has no registry client and no environment read beyond
the credential-shaped-variable refusal check. See
OCI Deployable Artifact v1 for the emitted
layout and the no-base-layer/no-signing/no-publish decisions.
platform-tests/owned-data-browser-v1/project owns a separate fixed direct-Bytes
browser subject. Its Rust fixture test authenticates the Project and inline
carrier; its provisioned browser runner imports the actual generated package
into a test-owned isolated document for hostile-input and lifecycle checks.
It does not authenticate the host's source provenance or replace physical
cleanup evidence. The existing three-engine gate remains included in the v0.4.0 hosted-green regression corpus.
examples/frame-payload-project, examples/frame-payload-web,
examples/frame-payload-rust, and tests/frame_payload_product_v1.rs form one
authored validation product over an identical corpus. Its lanes cover the
reference interpreter, native C11 O0/O2, Core Wasm/Node, generated npm, and
generated Rust package, including stable-ID display rename and settlement
facts. The external Rust fixture has a committed standalone lock and uses
--locked --offline; strict TypeScript 5.8.3 and Chromium/Playwright 1.62.0
fixtures require explicit local provisioning and download nothing. Node and
browser entry points share one corpus runner. The browser gate consumes
host-provisioned before/after artifacts rather than authenticating their source
derivation; the Project test owns that rename proof. Selected local passes do
not establish exact-head hosted promotion. Gate selection is
documented in the web consumer and
browser fixture.
tests/support/owned_frame_artifacts.rs shares the held-Project descriptor,
provider and published-package replay between that product and the explicitly
provisioned tests/release_archive_product_v1.rs archive gate. The archive gate
uses caller-selected unpacked binaries outside the checkout for calculator,
read-only daemon and generated-consumer checks; the existing frame suite keeps
its interpreter/native/raw-Wasm execution lanes. Archive inventory and label
agreement establish self-consistency, not build provenance. The
release process owns selection and evidence limits.
src/project/flat_owned_record.rs is the authority-free additive Project-v9
description layer. It authenticates the exact one-direct-Bytes flat record
result shape from HIR, independently replays its versioned descriptor, and
projects safe TypeScript/Rust types, a low-level C boundary, a value-only C++17
adapter, and an opaque-handle settlement plan. The C++ adapter owns its private
provider context, copies and settles the sole byte handle, closes the context,
and only then publishes a host-owned aggregate; it exposes no native layout.
src/project/npm/flat_owned_record.rs, the aggregate-aware owned-data Wasm
adapter, and the root native provider wire that descriptor to the additive npm
and safe-Rust package routes. The lower unpublished package crate replays the
descriptor, provider integrity binding, held tools, and publication facts,
then verifies the renamed stage through its retained stage authority. It does
not authenticate provider semantics; root HIR/codegen replay alone owns that
proof. No route exposes a target aggregate layout. See Public Flat Owned
Record API v1.
The compiler-private src/project/npm/semantic_recipe_v8.rs is shared by
owned-data npm and Project Rust replay. Its collision-only type-name projection
retains original presentation facts, then reconstructs the resolved declaration
index through the existing owned-data linker before descriptor or target replay.
It does not grant publication authority or replace the descriptor's identity
contract. Source identity literals use the source formatter, independently of
the canonical JSON descriptor writer.
Project v10 adds the distinct owned-utf8-api.v1 descriptor without treating
text as raw Bytes. The root Wasm and native adapters retain the exact byte
length, validate UTF-8 before host publication, and preserve the opaque
provider-handle settlement boundary. npm consumes the carrier before fatal
decoding to a JavaScript string. The dependency-inverted lower Rust package
replays the v10 digest domain and provider-integrity binding, owns held tools
and publication, verifies the renamed stage through retained stage authority,
copies and settles the handle, and only then constructs a safe String;
invalid UTF-8 therefore cannot escape or retain provider ownership. It receives
no HIR and cannot independently prove provider semantics; root HIR/codegen
replay alone owns that proof. V8/v9 renderer and carrier identities remain
separate. See Public Owned UTF-8 API v1.
Project v11 keeps nested owned-record results in a separate descriptor and
carrier family. src/project/nested_owned_record/ owns target-neutral shape
and stable-path authentication; src/wasm/owned_data_exports/nested_record.rs
and src/codegen/native_owned_data_provider/nested_record.rs independently
replay target layouts. The npm and safe-Rust consumers validate every private
owner before copying any payload, copy the full bounded batch, settle all
owners, and publish the nested value last. No target aggregate layout or raw
owner handle enters the public API. See Public Nested Owned-Record API
v1.
For v10 Wasm, src/wasm/aggregate/owned_strings.rs owns inline String cell
settlement derived from validated HIR and exact emitter locals, separately
from resource CleanupPlan liveness. Place reads clone; temporary moves clear;
scope and failure exits sweep nonescaping owners. owned_stack.rs derives a
checked selected-call-path arena bound from these cells plus Bytes cleanup
leaves. For the v10 native provider only,
src/codegen/native_emit/owned_strings.rs owns a separate per-function physical
String ledger. Bounded staged emission hoists initialized owner cells before
failure branches; expression lowering moves ownership at binding, branch,
call, and result boundaries. Normal scope cleanup and the common epilogue
settle those cells without reinterpreting resource CleanupPlan liveness.
Neither ledger confers provider-handle or publication authority. The separate
ordinary/stdout correction reuses the native ledger without changing v10
provider bytes. Frozen earlier provider and command profiles retain their
existing unselected-String cleanup limitation; Wasm accounting and
context-handle closure alone do not prove native allocation settlement.
src/project_revision_store.rs and src/project_revision_store/unix.rs own
the additive Project Revision Store v1. The
authority-neutral layer independently binds canonical manifest/source facts,
Workspace and Project revisions, and the Project graph digest into one closed
content-addressed entry. The Unix authority layer opens one host-injected
absolute root component-by-component, requires current-euid ownership and
exact 0700 mode, and treats the advisory lock only as cooperating-caller
serialization under an explicit host guarantee excluding uncooperative
same-principal mutation. It performs all reads and effects relative to held
descriptors, retains every created parent authority, publishes a completely
replayed create-new stage with a same-root no-replace rename, and settles held
directories before and after the pivot. Root admission authenticates and
caches unrelated content-addressed metadata and structural/identity facts once
per invocation; later checks revalidate names and top identities without
rereading metadata. Selecting an entry or
publishing a new one additionally owns all bytes and rebuilds meaning through
the ordinary Project Phase-A/HIR path; stored bytes never bypass verification.
For read availability, one exact inert stage-shaped top identity may be cached
and rechecked without being opened or traversed; persistence still rejects all
residue. A pure locator exposes the deterministic subject digest so callers can
resolve post-pivot ambiguity only through ordinary full load replay. Neither
surface adopts, deletes, repairs, or authorizes the stage. Darwin callers also
own the explicit host precondition excluding ancestor and ACL-granted mutation
authority that owner/mode checks cannot prove.
The separately selected Windows-entry-v1 route
uses additive APIs and a distinct schema/domain; ordinary v1 stays Unix-only
with unchanged bytes. Its Windows orchestration and unpublished
semaprax-project-revision-store-windows-sys quarantine accept only drive-absolute fixed local NTFS,
opens every component relative to retained handles, authenticates exact token
SID/protected-DACL/identity/link/stream/short-name facts, serializes by a
validated root-identity mutex, and performs one no-replace non-POSIX
handle-relative rename. Unsafe Windows calls remain quarantined behind opaque
safe handles and facts; raw handles and unsafe FFI do not enter the compiler crate. Other
hosts fail before an entry effect. No store handle, receipt, daemon integration, build authority,
cleanup, recovery, eviction, or garbage collection is exposed.
src/project_transport/ and src/bin/semapraxd.rs retain one authenticated
Project revision for bounded requests. Read-only v2 is the default. Explicit
opt-ins add one server-derived rename, the bounded workflow, or the additive
read-only Project v8 descriptor/npm carrier surface. Additive Transport v6 is
a separate opt-in read-only surface over exactly Project v8-v11. The retained
manifest profile, never a request field, selects the typed descriptor and npm
carrier schema. V5 and v6 compare each independently replayed carrier's typed
descriptor binding with the separately replayed retained descriptor before
returning either. src/project_transport/session/owned_data.rs owns frozen v5;
src/project_transport/session/public_api.rs owns v6 dispatch and complete
wrapper budgeting; src/project/npm/carrier.rs owns profile-specific carrier
replay and descriptor authentication. These profiles do not add general patch,
filesystem, process, publication, network, persistence, or recovery authority.
The generated v6 codecs remain pure request/response codecs. Their conformance
harness executes Python and provisioned Node/TypeScript adapters as closed-
environment direct children and compiles the exact generated Rust codec into
the owning Rust harness. This is local codec evidence, not a general process,
tool-provenance, registry, or hosted-client authority claim.
Reports and projections
Read-only commands are implemented in focused modules such as
src/abi_report.rs, src/c_header.rs, src/cxx_shim.rs and its bounded
src/cxx_shim/package.rs replay/package child,
src/capability_manifest.rs, src/freestanding_object.rs, src/openapi.rs,
src/package_report.rs, src/plugin_manifest.rs, src/region_report.rs,
src/simd_report.rs, and src/ui_schema.rs.
src/doc.rs is the documentation projection. It builds one model of a checked
module's declarations from the parsed program and its comments (identities,
canonical signatures without bodies, ownership modes, effects, contracts,
members, and leading-comment descriptions) and renders it as Markdown or as a
one-line semaprax.doc.v1 document, both carrying graph::revision. It
reuses the canonical formatter's type, contract, and escaping writers, so a
signature is the formatter's text. src/cli/doc.rs owns the closed
doc <file> [--json] grammar and verifies before rendering. The projections
harness proves that every documented identity of a graph-carried kind is a
node of semaprax graph at the same revision. See
Documentation Projection v1.
src/query.rs is the declaration query: it filters the documentation model of
src/doc.rs by kind, name, identity prefix, and effect. Single-module queries
join src/call_index.rs; Project queries parse each retained authenticated
source for presentation facts and join the call edges of that same revision's
retained semantic graph. Project matches therefore include path/module/source
identity and cross-file callers without accepting an arbitrary library file as
a standalone executable. src/cli/query.rs owns input selection and the closed
grammar; src/cli/package.rs
rewrites package report|lock|resolve to the long-form routes and re-enters
the dispatcher. See Unified CLI v1.
src/agent_transcript.rs is the scripted Agent Runtime v1 host behind
agent run and agent replay: it parses a closed transcript of provider
responses and tool results, implements AgentHost by consuming them in order
with a zero clock and the transcript's policy epoch, runs the task through the
profile derived from the compiled AgentDefinition, and compares recomputed
evidence byte for byte on replay. It owns no transport, process, filesystem,
network, or credential authority, and it neither persists nor resumes a run.
See Unified CLI v1.
src/agent_proposal/runtime_v1.rs owns the authority-free generated bridge
from one exact compiler-derived Proposal Schema v1 shape to the frozen Runtime
v1 final-action grammar. compile_agent_proposal_runtime_v1_compatibility
cross-binds an already compiled Proposal schema and AgentDefinition;
AgentProposalRuntimeV1Compatibility::decode_and_render delegates untrusted
Proposal admission to the existing decoder before producing bounded canonical
AgentRuntimeV1ActionBytes. The exact canonical Proposal document becomes the
final message without case or field translation. The bridge neither parses a
competing proposal grammar nor selects a Runtime tool or invokes a host.
Runtime Profile, Task, Action, Trace, and Evidence v1 remain byte-frozen. See
Agent Proposal to Runtime v1
Compatibility v1.
The public context dispatcher resolves a Project directory or manifest before
standalone source verification. Project inputs authenticate and retain one
ProjectRevision, then render semaprax.project-semantic-context.v1 through
that revision's typed cross-file analysis index. The CLI projects those
authenticated facts into positional semaprax.project-agent-context.v1 rows,
binding the complete underlying artifact digest while applying the caller's
byte bound only to transferred compact bytes. File inputs retain the existing
Agent Context v1/v2 route and bytes. Direction, depth, and node bounds map
exactly; Project context rejects file-only facet filters.
src/cli/add.rs extends a table manifest through
ProjectManifest::with_dependency, which inserts the row, renders the
canonical table layout, and re-parses before the one write. src/cli/fetch.rs
replays each named Subject-v3 envelope through package_lock_v3 and files it
into the resolver's content-addressed cache by its own digest; it decides every
address before writing any, and resolve remains the cache's only reader. See
Unified CLI v1.
src/cli/verify.rs is the schema-selected front over the independent
verifiers: it reads a capsule's top-level schema once, selects the verifier
admitted for that schema and operand count from a closed table, and hands the
unchanged paths to it; the receipt is the verifier's bytes and the front adds
no verification or authority. src/cli/agent.rs owns the agent verb and
admits only inspect, which prints agent_definition's AgentGraph v1 or
profile projection. See Unified CLI v1.
src/package_lock.rs is an authority-free additive offline graph layer above
the Interface Package Report. It accepts only explicit already-owned subject
envelopes, independently replays each exact report, rejects coordinate and
graph confusion, derives deterministic dependency-first order, exact target
intersection, and transitive declared-capability closure, then emits an
independently replayable lock to memory/stdout. src/cli/package_lock.rs
retains each explicitly
named input handle, rejects duplicate held file identities, and reads it once;
neither layer discovers paths, resolves or fetches versions, runs scripts,
compiles targets, publishes files, or treats optional license/provenance claims
as signed or trusted facts. See Offline Package Lock v1.
src/package_report_v2.rs and src/package_report_v2/ define the additive
self-contained Semantic Package Report v2. Its verifier rebuilds the exact
report from embedded canonical source through the ordinary verifier and
validated HIR. Stable-ID type/ownership/effect/contract facts, reachable
nominal closure, and closed ternary target proofs are read-only evidence; the
surface performs no compatibility decision and grants no package authority.
See Semantic Package Report v2.
Additive package_lock_v2 binds exact source-replayed V2 reports into a
bounded offline graph. package_compatibility emits stable-ID-only comparison
evidence; unknown closure or lock-context drift is indeterminate. See
Lock v2 and
Compatibility Evidence v1.
Additive package_resolver is an authority-free deterministic selector over a
finite caller-owned catalog of those exact source-replayed V2 subjects. It
normalizes strict semantic versions and the three frozen range forms, applies
target and declared-capability admission, explores one transactionally bounded
DFS trace, and emits exact replay evidence containing one unchanged Lock-v2
result. The focused public evidence is implemented. This layer performs
no discovery, registry or network access, fetch, build-script or target
execution, cache, publication, signature/provenance authentication, or runtime
capability enforcement. See
Offline Deterministic Package Resolver v1.
Additive package_resolution_snapshot packages exact caller-owned Resolver-v1
input, unchanged resolution evidence, and the returned unchanged Lock-v2 into
three independently replayable byte strings. Raw Subject-v2 envelopes remain
embedded byte-for-byte and are never JSON-re-rendered. The pure layer has no
filesystem authority. The lower semaprax-offline-wasm-package crate exposes
only one fixed three-file create-new publication facade through its existing
held/no-replace authority state machine; an internal sealed inventory preserves
the build-v1/v2 names, order, bytes, and failure selection. Evidence is release-tested and the surface is unpromoted. See Offline Published Semantic Lock
Snapshot v1.
Additive package_lock_v3 authenticates package dependency ranges in new
Subject-v3 envelopes and binds each range to the selected coordinate in a new
dependency-first Lock-v3 graph. package_resolver_v2 intersects those root
and transitive ranges during deterministic bounded search and exactly replays
Lock v3. These modules are release-tested. They do not widen the
v1/v2 subjects, locks, resolver, CLI, capsule, build, compatibility, or
publication surfaces and gain no registry, network, acquisition, cache, build,
execution, or publication authority. See Lock v3
and Resolver v2.
Additive package_source_capsule consumes exact Resolver-v1 replay and two
through four caller-owned canonical implementation sources. The ordinary
semantic-workspace graph derives function imports over synthetic logical paths,
exact-compares that direct module graph with the selected Subject-v2 graph,
and exact-compares normalized scalar interface vectors with selected Report-v2
facts before using a package-only variant of the existing authority-free scalar
HIR linker. It retains every explicit root export and its transitive callees,
uses the byte-lowest root-owned fn() -> i64 only as the HIR anchor, and leaves
the Project linker's authored-main rule unchanged. Report source is interface
evidence only; capsule source is the sole executable code. The explicit
selected root and only its sorted explicit export IDs are bound in the capsule,
while a crate-private replay seam retains linked HIR for the separate
linked-build consumer. The implemented surface has hosted-green release evidence and adds no build or
publication authority. See Offline Multi-Package Source Capsule
v1.
package_semantic_graph consumes that same complete capsule replay to retain
coordinate-qualified package, source, interface, import and cross-package call
facts. Its immutable consumer index is independent of a Project image. A v5
host may attach the verified graph before requests and expose read-only package
queries through the selected discovery and parallel-read paths; equal stable
IDs do not establish any Project/package relationship. No source, acquisition,
build or publication authority crosses this boundary. See
Package Semantic Graph.
Additive package_build consumes that exact resolver evidence only through an
independent replay route. The v1 profile deliberately admits one selected,
dependency-free Subject v2 whose embedded canonical source is rebuilt through
Report v2 and the ordinary verifier/HIR path. It then reuses the unchanged
Public Scalar Export Profile v1 to emit one structurally validated Core-Wasm
module, a canonical manifest, and independently replayable evidence. The
module's seven fixed env function imports are recorded as runtime semantic
dependencies; they are not SEMAPRAX capability declarations. Submitted
manifest/evidence facts never become reconstruction inputs. The pure compiler
layer has no filesystem, process, registry, network, publication, runtime, or
sandbox authority. See Offline Effect-Free Scalar Core-Wasm Package Build
v1.
Additive package_build_v2 consumes only the capsule's independently replayed
private receipt and retained linked HIR. It emits a distinct canonical v2
manifest/evidence pair around the unchanged effect-free scalar Core-Wasm
emitter, binds the complete selected package closure plus capsule, source-set,
link, and root-export facts, and revalidates the exact seven-import/export
inventory. Its two-package, cross-pair, mutation, bound, fixed-point, and
publisher evidence is implemented. It adds no source reconstruction,
external tool, registry, runtime, or publication authority. See Offline
Linked Scalar Core-Wasm Package Build v2.
The separate semaprax-offline-wasm-package crate is the only publication
boundary for both build profiles. Its safe facade replays the complete caller-owned
build before acquiring a held destination, stages exactly three create-new
files, exact-compares held staged bytes before settle, and performs one
no-replace directory publication. File handles are settled before that rename;
post-publication authentication reopens the fixed inventory through the renamed
held directory and compares it with the retained identity-and-digest proof.
Previsibility cleanup is limited to the
authenticated stage inventory; publication uncertainty is fail-stop. This is
create-new local publication, not acquisition, a registry/cache, provenance,
runtime enforcement, or a hermetic operating-system build sandbox. Its
implemented regression evidence is hosted green and the crate is unpromoted. Every platform has the
explicit host precondition excluding every uncooperative mutation of the
destination path, parent, ancestors, or stage for the invocation. Unix/macOS
additionally requires and checks a current-euid-owned exact-mode-0700 parent;
the precondition includes Darwin ACL-granted authority because POSIX directory
creation cannot atomically return the created directory handle.
These modules must:
- consume verified representations;
- use closed admission and exclusion vocabularies;
- emit deterministic bounded output;
- independently replay digest-authenticated envelopes where specified;
- make target execution and unsupported surfaces explicit non-claims.
A report can deepen a completion row from Missing to Partial. It cannot prove the runtime or ecosystem feature it describes.
Private host and proof boundaries
The following areas are deliberately quarantined from the public compiler contract:
crates/semaprax-native-loader: unsafe dynamic-loader boundary;crates/semaprax-native-host: connected callable and settlement host;crates/semaprax-native-rust-interop-*: unpublished deterministic Rust SDK builder and platform-specific publication authority;crates/semaprax-native-rust-interop-platform/src/host_target.rs: shared compile-time native target classification; scalar and owned-data package callers retain their narrower publication allowlist, separate from private Phase-A target preparation and all held-tool authority;crates/semaprax-native-rust-owned-data-package: dependency-inverted Project-v8 held-tool, archive, deterministic rendering, publication, and held-stage verification authority; it receives no source, HIR, or provider semantic-authentication authority;src/native_settlement.rs,src/arc_zones.rs, andsrc/scoped_tasks.rs: target-neutral proof models rather than wired runtime features;src/agent_definition.rs: the additive canonical AgentDefinition v1 compiler, deterministic AgentGraph v1 projection, and canonical Runtime v1 profile compatibility boundary; it has no language parser or execution authority;src/agent_harness.rs: the authority-free AgentDefinition/Economic Policy graph binding and the injected-host Runtime v1 to Economic Agent v1 handoff; it owns no provider, journal, approval, custody, chain, or broadcast host;src/agent_runtime.rsandsrc/economic_agent.rs: injected-host Rust APIs with no built-in provider transport, keys, wallet, or ambient authority;platform-tests/: installed application and runtime fixtures whose claims count only when the owning hosted jobs are green.
Private or proof-only evidence may validate a design boundary without creating a supported language, CLI, ABI, or runtime surface.
Trust boundaries and invariants
- Safe source must have equivalent checked behavior on every backend that claims to implement the admitted feature.
- Evaluation order is left to right; lazy boolean operands execute only when required.
- Public declaration IDs persist; expression IDs may be revision-scoped.
- Source formatting, graph JSON, reports, diagnostics, patches, and generated artifacts covered by a contract are deterministic.
- Failed or stale transactions leave authoritative source or the active generation unchanged.
- Capabilities are explicit. Compiler and generated code gain no ambient filesystem, process, network, home, or secret authority.
- Ownership errors are compile-time diagnostics, never backend accidents.
- Owned calls stage arguments left to right and transfer them together at the declared commit boundary.
- Proof data never authorizes a physical finalizer, build, or publication.
- No feature is complete without the completion matrix's executable gate.
Internal owned-data libraries
workspace_graph/owned_function_import.rs authenticates explicit nongeneric
record signatures over Bytes and Copy scalars. expected_projection/defaults.rs
precharges checking-only empty byte leaves with separate admitted/closed memo
entries; actual execution retains the provider body and ordinary HIR/cleanup
replay. Ordinary owning record-match results use the same result transfer
before arm settlement in source verification, HIR, cleanup replay, interpreter,
C11 and Core Wasm. No target repairs the canonical plan.
The Project v8 empty-export route admits checked internal libraries in either
manifest layout while leaving descriptor and public-package routes absent.
Nonempty exports retain their original admission rules. std/io owns the
source-level Reader/Writer cursor contracts and composes only caller-provided
buffers; standard_dependencies.rs bundles its exact module. The standard
library harness projects record and function documentation through its catalog
child and exercises the package across the three execution lanes.
Repository map
| Area | Primary owners |
|---|---|
| Source projection | src/ast.rs, src/lexer.rs, src/parser.rs, src/format.rs |
| Verification | src/verify.rs, src/source_verify.rs, src/source_verify/ — declaration/ owns the per-pass declaration checks, iterative/ the frame machine, oracle/ the test-only recursive cross-check, function_value_inventory.rs the lexical function-value reference/candidate inventory, hints.rs the shared fix hints both verifiers attach to unknown-function, generic-argument, literal-suffix, and borrowed-view diagnostics, and loans.rs/place.rs the loan lifecycle |
| HIR | src/hir.rs, src/hir/ — ids.rs, nodes.rs, and expr_nodes.rs own the data model; resolve_*.rs own AST lowering; function_value.rs owns independent callable target/signature validation; validation.rs owns core validation |
| Cleanup and layouts | src/cleanup.rs, src/cleanup_plan.rs, src/cleanup_plan/, src/aggregate_layout.rs, src/variant_layout.rs |
| Graph and read-only analysis | src/graph.rs, src/graph_cleanup.rs, src/call_index.rs, src/impact.rs, src/review.rs, src/doc.rs, src/query.rs; src/graph/function_facts.rs owns per-function agent-context fact rendering (split out of src/graph.rs to stay under its module-size budget); src/graph/session_protocol_facet.rs owns issue #206's session_protocol_kernel projection -- this compiler's built-in src/session_protocol/ reference-kernel catalog surfaced as declaration-independent reference data, behind AgentContextFilter::SessionProtocol in context (CLI-reachable via --filters session_protocol) and as the standalone graph::session_protocol_kernel_json() Rust API with no CLI verb of its own -- explicitly not a fact about any .spx declaration, since none is bound to a ProtocolSpec, and deliberately not merged into graph's own per-program to_json output (see that function's doc comment for the byte-budget regressions that ruled the merge out); tests/projections/shapes_catalog.rs generates the Markdown and JSON language-shape catalogs, tests/documentation.rs::agent_quick_reference generates the indexed diagnostic-help companion from the compiler-checked language card, and src/cli/help.rs selects bounded exact or smallest-exemplar shape, diagnostic, and language-section results from those static projections |
| Semantic retention metadata | src/semantic_retention.rs, src/semantic_retention/, receipt adapter in src/candidate_archive_store.rs |
| Retention metadata persistence | src/semantic_retention_store.rs, src/semantic_retention_store/, explicit adapter src/cli/retention_metadata.rs |
| Retention registry cursor | src/semantic_retention_registry.rs, src/semantic_retention_registry/ |
| Automatic candidate/draft retention lifecycle | src/semantic_retention_lifecycle.rs, src/semantic_retention_lifecycle/automatic.rs, held replay adapters in src/candidate_archive_store.rs |
| Single-file transactions | src/patch.rs, src/patch/, src/patch_evidence.rs, src/repair.rs |
| Managed workspace | src/workspace.rs, src/workspace_*, src/semantic_workspace* |
| Canonical Project-derived semantic workspace revision | src/project/canonical_workspace_revision.rs |
| Segmented source-owned ProgramRoot | src/project/program_root.rs, src/project/program_root/v2.rs, src/project/program_root/v3.rs |
| Exact ProgramRoot selection contexts | src/project/exact_program_context.rs, src/project/exact_program_context/v2.rs |
| Contract association and declared-test facts | src/project/contracts_and_tests_facts.rs |
| Source Agent interaction contract facts | src/project/agent_contract_facts.rs |
| Project, public descriptor, and daemon | src/project/, src/project/public_api.rs, src/project_transport/, src/bin/semapraxd.rs |
| Project v8 promotion observation replay | src/project/v8_promotion.rs |
| Exact Project semantic references | src/project/image_reference.rs |
| Exact Project target reuse | src/project/target_cache.rs |
| Immutable Project revision inputs | src/project_revision_store.rs, src/project_revision_store/unix.rs |
| Generated Rust package authority | src/project/native_sdk.rs, crates/semaprax-native-rust-owned-data-package/, crates/semaprax-native-rust-interop-builder/; exact Project crate inputs originate in src/project/manifest/tables.rs |
| Signed doctor generation store | crates/semaprax-doctor-release/src/install.rs, crates/semaprax-doctor-release/src/install/ |
| Interpreter | src/interpreter.rs, src/interpreter/variant_admission.rs, src/interpreter/prepared.rs, src/hosted_interpreter.rs, src/project/prepared_interpreter/, src/project/prepared_interpreter/trace/ |
| Explicit Rust HTTP/TLS host runtime | src/https_client.rs, src/network_provider.rs, src/network_provider/tcp.rs |
| Filesystem I/O | src/filesystem_ops.rs owns the closed compiler operations and bounds; src/filesystem_provider.rs and src/filesystem_provider/ own explicit fixture, denied, and Unix scoped providers; src/interpreter/filesystem/ and src/project/filesystem.rs bind injected providers to checked execution; src/codegen/native_emit/filesystem_io.rs and src/codegen/native_emit/filesystem_io_v2.rs, and src/codegen/native_emit/filesystem_io_v3.rs own the native callback ABIs; src/wasm/filesystem_ops.rs, src/wasm/filesystem_v2.rs, src/wasm/aggregate/filesystem_ops.rs, and src/wasm/aggregate/filesystem_v2.rs own the injected Core-Wasm imports and v2 lowering; src/wasm/filesystem_v3.rs and src/wasm/aggregate/filesystem_checked.rs own checked outcome lowering; src/graph/filesystem.rs owns filesystem facts and the final src/graph/filesystem_outcome.rs wrapper selects Graph v46 without replacing environment/process/iterator facts; src/project/manifest/ owns Project v14 and private Project v15/v19 profile admission; std/fs/ owns the source-authored std.fs composition. Filesystem I/O v1 and Filesystem I/O v2 and Host Operation Outcome v1 own the frozen and additive contracts and authority boundary. |
| Environment I/O | src/environment_ops.rs and src/environment_snapshot.rs own the closed operation vocabulary, status domain, immutable snapshot bounds, and canonicalization; src/interpreter/environment.rs and src/project/environment.rs bind the caller-supplied snapshot; src/codegen/native_emit/environment_io.rs and src/codegen/native_emit/environment_runtime.c own the native callback ABI; src/wasm/environment_io.rs and src/wasm/aggregate/host_command.rs own the private Core-Wasm imports and lowering; src/graph/environment.rs owns Graph environment facts; src/project/manifest/ owns private environment-io.v1 admission; std/env/ owns the source-authored std.env composition. Bounded Environment I/O v1 owns the additive snapshot contract and authority boundary. |
| Process I/O | src/process_ops.rs owns the closed process_run operation, eight-argument signature, wire bounds, status domain, and Process v1 admission facts; src/process_provider.rs owns request/output encoding, reservation accounting, and provider settlement; src/process_provider/registered.rs owns held executable/cwd/tool registration and explicit environment/argv policy; src/process_provider/registered/platform.rs owns the separate Unix pipe, launch, Darwin vnode/executable attestation, Linux fexecve, deadline, group-kill/reap, and settlement quarantine boundary. This provider has no Git process authority. The selected std.process example, conformance, and bundled-consumer commands pass locally on the interpreter, native C11 -O0/-O2, and Core Wasm, with five focused physical Darwin provider cases also passing; Linux physical-provider and hosted/full-profile gates remain open. Bounded Process I/O v1 owns the additive contract. |
| Linked Agent lifecycle | src/project/agent_linked.rs owns retained Project source replay, deterministic role closure, linked Proposal schema derivation, and semaprax.agent-linked-source.v1; src/agent_lifecycle/iterative.rs and its effect extension own linked v3 lifecycle/v4 typed-effect schema composition; src/execution_revision/typed.rs owns bind_linked_agent_runtime_v2 and typed v3 roots. The path consumes ordinary checked source data and an injected effect driver; it grants no authority and has no native/Wasm Agent-stage claim. Project Linked Agent Lifecycle v1 owns the pending additive boundary. |
| Native backend | src/codegen.rs, src/codegen/native_*; Project-v13 HTTPS runtime in src/codegen/native_emit/http_io.rs, pinned trust data in src/codegen/mozilla-roots.pem |
| WebAssembly backend | src/wasm.rs, src/wasm/ |
| Reports and offline package graph | the focused *_report, package_lock, package_resolver, package_resolution_snapshot, schema, manifest, header, and shim modules; candidate replay/conflict projection in src/project/candidate/package_consumer_replay.rs |
| Project assurance evidence | src/project/ owns authenticated Project snapshot, canonical workspace revision, ProgramRoot, complete source inventory, shared entry/public/test HIR obligation derivation, and exact architecture-claim result binding for the additive Project Assurance Manifest v1; Project Assurance Manifest v1 owns the schema and replay boundary, while Assurance Manifest v1 remains the unchanged single-file profile. |
| Project dependency admission | src/project/external_dependencies.rs for exact ordinary Subject-v3 closure replay, including cross-package evidence for the provenance-independent ScalarV1 internal generic-owned body profile behind scalar calls/exports, and src/project/standard_dependencies.rs for compiler-bundled packages |
| Effect-free package build and fixed-inventory publication | src/package_build.rs, src/package_build/, src/package_build_v2.rs, src/package_build_v2/, crates/semaprax-offline-wasm-package/ |
| Private host/runtime evidence | crates/semaprax-native-*, platform-tests/ |
| Standard library | std/<package>/ Project packages, src/project/standard_dependencies.rs for closed bundled dependency expansion, std/packages.json tier and target metadata, generated std/catalog.json; src/cli/help.rs embeds the generated Markdown catalog unchanged and derives exact module/name/stable-ID lookups from the JSON catalog; gate tests/project/standard_library.rs |
| Owned bounded Vec | src/vec_ops.rs owns exact compiler intrinsic identities/signatures and bounds; src/prelude.rs owns core.vec, preserves frozen five-operation semaprax.prelude.v2, and selects additive v3 only for reserve/set/clear use; v6 binds the additive owned Bytes profile through graph and semantic workspace revisions. src/codegen/native_vec/owned_payload.rs, native expression vec_ops/owned_payload.rs and Wasm aggregate/vec_owned_payload.rs implement recursive initialized-payload settlement and versioned host imports. Source/HIR authenticate explicit scalar and admitted owned Bytes instances and same-owner rebind; cleanup and backends consume those identities. The bounded source for item in values { body } profile is resolver-owned sugar over one frozen simple immutable Vec<T> binding: it snapshots len once and lowers to existing len/get/while HIR, adding no HIR node, stable ID, graph/cleanup schema, prelude, backend operation, package declaration, or public ABI. Gates live in the existing language and owned-data harnesses; Owned Bounded Vec v1, Owned Bounded Vec v2 and Owned Bounded Vec For Traversal v1 own the exact profiles. |
| Owned bounded Box | src/box_ops.rs owns exact compiler identities and scalar/Bytes operation admission; src/prelude.rs preserves v1-v4 and adds v5 for owned Bytes payloads. src/cleanup_plan/deferred_commit.rs classifies allocation-before-transfer; replay/resolved_call.rs independently checks that ordering. src/codegen/native_box/owned_payload.rs and native/Wasm box_ops/owned_payload.rs consume the checked plan and implement recursive Bytes settlement through explicit v2 host imports. src/project/std_mem.rs still authenticates the frozen scalar no-export wrappers. Box v1 and Box v2 own their contracts; authored records named Box, broader aggregates, regions/arenas and public ABI remain separate. |
| Owning iterators | src/iterator_ops.rs owns the two compiler operation identities and scalar admission; src/prelude.rs owns core.iter and core.iter-step and selects additive v7. src/cleanup/iterator.rs, src/cleanup_plan/build/iterator.rs, and replay retain core.iter.drop plus the conditional Yield/rest owner path in CleanupPlan v10. src/hir/iterator_loop/renewal.rs, src/cleanup_plan/build/renewal.rs, and src/cleanup_plan/replay/renewal.rs own the narrowly authenticated conditional same-owner Vec renewal proof; src/wasm/aggregate/post_transitions.rs consumes replayed transitions as a lowering child. Graph/prelude bindings, canonical workspace revision, ProgramRoot, and cache codec preserve the selected facts, including the bounded one- or two-type-parameter carrier grammar. Native/Wasm lowering remains private; Owning Iterators v1 and Owning Iterator Renewal v1 own the profiles and their pending executable evidence. |
| Executable evidence | tests/, crate-local tests, platform-tests/, .github/workflows/ |
This table is the single module-level map. Other contributor documents should link here instead of copying it.
Module size
A Rust source file may not exceed 1500 lines unless tests/module-size-budget.tsv
records it, and a recorded file may not grow past the size it was recorded at.
tests/module_size.rs enforces both, and fails on entries that no longer exceed
the limit so the ledger shrinks with the code.
The constraint is a reading cost, not a style preference. A module that holds
several thousand lines forces every reader — and every agent context window — to
pay for the whole file to reach one item, and it makes unrelated edits collide in
one blast radius. Prefer splitting an oversized module into submodules that each
own one concern. An inherent impl may be split across several impl blocks in
different modules of the same crate, which is usually the cheapest behaviour-
preserving cut for the largest files here.
Two files exceed the budget because each is a single function whose locals are
shared across every branch — src/hir/resolve_expr.rs and
src/economic_agent/agent_execute.rs. Cutting those requires extract-method with
new signatures, which is a behavioural change and needs its own review; it is not
a relocation.
Integration test harnesses
Cargo builds every top-level file in tests/ as its own binary, and each one
statically links the whole compiler. The test code is a small fraction of that:
a typical file contributed ~1.5 MiB to a ~42 MiB binary. With one file per
subject the suite reached 393 binaries and over 11 GiB of executables, which
exhausted disks and dominated CI time.
Tests are therefore grouped into harnesses. A harness is tests/<group>.rs
declaring one module per former file, with the bodies in tests/<group>/:
#[path = "<group>/<name>.rs"]
mod <name>;
The #[path] is required: in a test crate root, plain mod foo; resolves to
tests/foo.rs, not to the subdirectory.
Add a new test as a module of the harness that owns its subject. A new top-level file links the compiler again and gives back the saving.
Four things follow from sharing one binary, each enforced or already paid for:
- Relative paths in
include_str!,include_bytes!, and#[path]resolve against the declaring file, so a body one directory deeper needs../. - Modules share a process id. A temporary fixture root built from a literal
prefix plus
process::id()collides if two modules use the same prefix, so every prefix in a harness must be distinct.tests/harness_isolation.rschecks this. - A test that re-invokes its own binary with
--exact <path>cannot be a module: merging prefixes the path and the selected case silently never runs. Such a file stays a top-level target.tests/harness_isolation.rschecks this too, keyed by path. - Two modules must not
#[path]-load the sametests/support/*.rs. Inside one crate that compiles the file twice and yields unrelated copies of its types;clippy::duplicate_modrejects it. Declare the support module once in the harness root and refer to it ascrate::<name>.
A file stays a standalone target when CI or a script selects it with
--test <name>, when another test reads it as text, or when it re-invokes its
own binary. Documentation cites tests by path and tests/documentation.rs fails
on an unresolvable link, so citations move with the code, and a documented
--test <old> <filter> becomes --test <group> <module>::<filter> — the
module:: form matters, since a bare second positional is read as a second
libtest filter.
Source-locked contracts
Some gates assert over the text of a module: they read a .rs file with
include_str! or a path read, then require substrings, forbid others, count
occurrences, or slice the region between two markers. tests/economic_agent_v1.rs
scans for ambient authority this way, tests/native_rust_interop_ci_contract.rs
and crates/semaprax-native-rust-interop-platform-sys/src/tests.rs bind physical
authority boundaries, and implementation/tests/ledger_capacity.rs pins layout
constants.
Splitting a module silently narrows every such gate: the text moves to a sibling
file, the assertions still pass against the smaller root, and the coverage is
gone with nothing failing. When a split moves audited text, join the root and its
submodules — with concat!(include_str!(..), ..) or a path-reading helper — so
the contract binds the complete module. Use original source order, not the
alphabetical order mod declarations are formatted into, whenever the contract
slices a region between two markers. tests/source_locked_contracts.rs fails
when a reader binds a module root but not its submodules.
The bounded generic inference helpers in source_verify/generic_inference and
hir/generic_inference independently unify exact argument types before normal
argument evaluation. Their bounded type-evidence traversal observes expression
types without invoking ordinary expression checking or ownership transitions.
They retain the explicit concrete instance representation;
source and graph replay remain bound to each projection's own source revision.
The declaration precheck in source_verify/declaration/functions independently
builds scoped static type facts for omitted generic-template mappings before
checking every admitted concrete substitution. Unknown or shadowed facts cannot
supply a stale mapping. HIR inference retains caller-owned parameter identities,
and nested evidence shares one bounded walk; graph mapping continues to consume
checked symbolic calls through authenticated structural paths.
execution_revision/typed_migration consumes actual durable suspension evidence,
rechecks old/new retained State schemas and executes the pure migration. Its
private MigrationSeed is the only initial-state entry to the iterative driver;
iterative/effects/continuation carries cumulative usage and binds subsequent
execution to that seed. typed_migration/handoff owns the bounded handoff
codec, while typed_migration/durable commits the handoff before destination
work and recovers only against caller-trusted snapshots and independently bound
runtime roots. The recovered object exposes only durable execution.
typed_migration/linked reconstructs the exact checked role association and
selects a single declared or explicitly imported migration through
project/agent_linked; migration preparation and recovery share that selection
and the owned-parameter/pure-call validator. Linked migration root v3 carries
the selected source associations while both direct paths retain v1/v2 bytes.
iterative/effects/durable retains the v2 local journal and carries the immutable
migration baseline into additive v3 evidence and cumulative budgets. Parsed
hashes alone cannot authorize seed recovery or host work.
Owned string variant admission and the compiler primitive core.string.drop
are specified by Owned String Variants v1.
Inventory and cleanup replay own the lifecycle; native and Wasm finalizers
consume its canonical actions. String clone initialization helpers live in
cleanup_plan/build/strings and independent replay in cleanup_plan/replay/strings.
Native scalar-match scope lookup lives in codegen/native_bytes/scalar_match_scope;
Wasm lookup and action emission live in wasm/aggregate/cleanup.
wasm/aggregate/string_runtime owns optional aggregate String intrinsic imports;
wasm/browser_runtime.js owns their generated web adapter and byte-carrier
validation. It is included verbatim by the browser runtime renderer.
The final uncached workspace graph path extracts cross-module declaration and
signature proof in workspace_graph/validation while each full resolved HIR is
live. It then retains only the selected output carrier before resolving the
next module. Compact proof storage and the single live resolver peak remain
charged within the existing builder cap. The final uncached path reserves the
largest synthetic AST before cloning, retaining that monotonic peak reservation
as each temporary AST is dropped. Compact signature clones receive explicit
recursive heap charges before allocation; declaration maps reserve each entry
before insertion. The remaining forecast covers retained HIR, and earlier
fallback profiles retain their existing forecast calculations.
Only that final uncached profile resolves modules in descending temporary-HIR overhead with a path tie-break, using a fixed-size stack index. Its forecast uses the identical schedule, and retained modules return to canonical path order before cross-module validation and publication. Earlier profiles keep their existing resolution order.
Public-generic calling-consumer settlement ownership
public_generic_consumer::{c_calling,cxx_calling,rust_calling} continue to own
codecs and caller settlement. Their render/ text assets are consumed by the
existing deterministic generators, with reverse field-order cleanup emitted by
thin shape renderers. tests/public_generic_native_adapter_v1/consumer_settlement
and the corresponding Python scripts own test-only allocation/hostility
observations, not a second provider. The Cargo bridge byte-compares actual
generator output with fixture assembly before executing it. The authoritative
contracts and nonclaims live in Settlement Corpus v1.
The TypeScript caller follows the same ownership split:
public_generic_consumer/typescript_calling/render.rs emits shape-dependent
fragments, while every fixed runtime/test fragment is a normalized render/
text asset. tests/public_generic_wasm_adapter_v1/settlement and the TypeScript
settlement scripts own the host-only corpus, independent oracle, byte-fixture
assembly, hostile module/handle checks and replay. The actual-generator Cargo
bridge is separate from template-only execution. No new compiler Wasm target,
provider ABI, allocator authority or generic export admission is introduced.