From d65cc6ff6474afd442236026dedb38dd5f50ae37 Mon Sep 17 00:00:00 2001 From: James Ross Date: Mon, 24 Aug 2026 07:45:14 -0700 Subject: [PATCH 1/2] Add sealed Echo runtime host facade --- CHANGELOG.md | 8 + Cargo.lock | 10 + Cargo.toml | 4 +- README.md | 11 +- crates/echo-runtime/Cargo.toml | 28 ++ crates/echo-runtime/README.md | 16 ++ crates/echo-runtime/src/lib.rs | 274 +++++++++++++++++++ crates/echo-runtime/tests/host_lifecycle.rs | 47 ++++ crates/warp-core/src/causal_anchor.rs | 5 +- crates/warp-core/src/causal_wal.rs | 42 +-- crates/warp-core/src/contract_host.rs | 2 +- crates/warp-core/src/contract_obstruction.rs | 2 +- crates/warp-core/src/contract_registry.rs | 26 +- crates/warp-core/src/coordinator.rs | 78 +++--- crates/warp-core/src/engine_impl.rs | 75 ++--- crates/warp-core/src/head_inbox.rs | 12 +- crates/warp-core/src/lib.rs | 9 +- crates/warp-core/src/provider_contract.rs | 52 ++-- docs/topics/GeneratedRules.md | 18 +- docs/topics/RuntimeAuthority.md | 10 + scripts/verify-local.sh | 70 +++-- 21 files changed, 599 insertions(+), 200 deletions(-) create mode 100644 crates/echo-runtime/Cargo.toml create mode 100644 crates/echo-runtime/README.md create mode 100644 crates/echo-runtime/src/lib.rs create mode 100644 crates/echo-runtime/tests/host_lifecycle.rs diff --git a/CHANGELOG.md b/CHANGELOG.md index 7d09a7aa..9fd4e5a5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,14 @@ ### Added +- The unreleased `flyingrobots-echo-runtime` crate now proves the first sealed + Rust host facade over Echo's trusted runtime and WAL recovery lane. The + trusted host implementation can compile without `native_rule_bootstrap`, and + the facade exposes bounded configuration plus read-only recovery evidence + without exporting the underlying engine, native rule registration, or raw + receipt, authority-epoch, and commit constructors. Installation, submission, + scheduling, outcomes, and receipts remain outside this first boundary; the + crate is explicitly `publish = false` and authorizes no release. - The checked Edict provider contract now admits generic nominal Core types as exact contract coordinates over bounded storage representations. The regenerated provider package remains application-neutral and adds no Jim, diff --git a/Cargo.lock b/Cargo.lock index 5867b94d..b0946974 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -831,6 +831,16 @@ version = "0.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8ce81f49ae8a0482e4c55ea62ebbd7e5a686af544c00b9d090bba3ff9be97b3d" +[[package]] +name = "flyingrobots-echo-runtime" +version = "0.1.0-alpha.1" +dependencies = [ + "blake3", + "tempfile", + "thiserror 1.0.69", + "warp-core", +] + [[package]] name = "fnv" version = "1.0.7" diff --git a/Cargo.toml b/Cargo.toml index a763c35c..f9c99215 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -2,6 +2,7 @@ # © James Ross Ω FLYING•ROBOTS [workspace] members = [ + "crates/echo-runtime", "crates/echo-runtime-schema", "crates/warp-math", "crates/warp-core", @@ -42,12 +43,13 @@ echo-file-aperture = { version = "0.1.0", path = "crates/echo-file-aperture" } echo-graph = { version = "0.1.0", path = "crates/echo-graph" } echo-runtime-schema = { version = "0.1.0", path = "crates/echo-runtime-schema", default-features = false } echo-registry-api = { version = "0.1.0", path = "crates/echo-registry-api" } +echo-runtime = { version = "0.1.0-alpha.1", path = "crates/echo-runtime" } echo-edict-canonical = { version = "0.1.0", path = "crates/echo-edict-canonical" } echo-scene-codec = { version = "0.1.0", path = "crates/echo-scene-codec" } echo-scene-port = { version = "0.1.0", path = "crates/echo-scene-port" } echo-wasm-abi = { version = "0.1.0", path = "crates/echo-wasm-abi" } warp-math = { version = "0.1.0", path = "crates/warp-math" } -warp-core = { version = "0.1.1", path = "crates/warp-core" } +warp-core = { version = "0.1.1", path = "crates/warp-core", default-features = false } # ── Workspace-wide lint policy ────────────────────────────────────── # Maximum strictness. Crates opt in via `[lints] workspace = true`. diff --git a/README.md b/README.md index 76ad2658..e8804ac6 100644 --- a/README.md +++ b/README.md @@ -196,10 +196,13 @@ application-owned Edict operation now crosses it through a compiler-produced package and structurally separate accepted verification report, but no Jedit rope lawpack or `ReplaceRange` operation uses it. It does not yet claim cross-category scheduler composition or independently implemented semantic -conformance. It also temporarily reuses `TrustedRuntimeHost`'s joint -`native_rule_bootstrap` and `trusted_runtime` feature gate. The program itself -has no native hooks, but the host surface must be decoupled from the legacy -bootstrap feature before a product can remove that compatibility feature. +conformance. The existing `xtask` witness still enables both +`native_rule_bootstrap` and `trusted_runtime`, but the trusted host and WAL +implementation can now compile without `native_rule_bootstrap`. The unreleased +`flyingrobots-echo-runtime` crate proves a sealed +construction-and-recovery facade over that lane. Package installation, +submission, scheduling, and receipt access have not yet moved to the facade, so +it remains `publish = false` and is not yet the external product host boundary. The following sequence is the existing Wesley bootstrap fixture: diff --git a/crates/echo-runtime/Cargo.toml b/crates/echo-runtime/Cargo.toml new file mode 100644 index 00000000..0c091a8b --- /dev/null +++ b/crates/echo-runtime/Cargo.toml @@ -0,0 +1,28 @@ +# SPDX-License-Identifier: Apache-2.0 +# © James Ross Ω FLYING•ROBOTS + +[package] +name = "flyingrobots-echo-runtime" +version = "0.1.0-alpha.1" +edition = "2021" +rust-version = "1.90.0" +description = "Sealed host facade for the Echo causal runtime" +license = "Apache-2.0" +repository = "https://github.com/flyingrobots/echo" +readme = "README.md" +publish = false +include = ["src/**", "tests/**", "README.md"] + +[lib] +name = "echo_runtime" + +[dependencies] +blake3 = "1.0" +thiserror = "1.0" +warp-core = { workspace = true, default-features = false, features = ["trusted_runtime"] } + +[dev-dependencies] +tempfile = "3" + +[lints] +workspace = true diff --git a/crates/echo-runtime/README.md b/crates/echo-runtime/README.md new file mode 100644 index 00000000..290b4591 --- /dev/null +++ b/crates/echo-runtime/README.md @@ -0,0 +1,16 @@ + + + +# Echo Runtime for Rust + +`flyingrobots-echo-runtime` exposes the Rust library name `echo_runtime`. It is +the first sealed host facade for constructing and recovering a local Echo +runtime and WAL shell without exposing native rule registration or raw receipt, +authority-epoch, and commit constructors. + +Package installation, application submission, scheduling, and receipt access +are not yet exposed through this facade. Those capabilities remain release +engineering work and must be added only through bounded, authority-safe APIs. + +This package is an unreleased alpha boundary with `publish = false`. It is not +available on crates.io and does not authorize publication. diff --git a/crates/echo-runtime/src/lib.rs b/crates/echo-runtime/src/lib.rs new file mode 100644 index 00000000..a8e8d4f4 --- /dev/null +++ b/crates/echo-runtime/src/lib.rs @@ -0,0 +1,274 @@ +// SPDX-License-Identifier: Apache-2.0 +// © James Ross Ω FLYING•ROBOTS +//! Sealed host facade for the Echo causal runtime. +//! +//! The facade owns trusted runtime construction and WAL activation without +//! exposing native rule registration or constructors for receipts, authority +//! epochs, or committed outcomes. It remains `publish = false` while the +//! release boundary is qualified. +//! +//! Runtime internals are not part of this facade: +//! +//! ```compile_fail +//! use echo_runtime::{RewriteRule, TrustedRuntimeHost}; +//! ``` + +use std::path::{Path, PathBuf}; + +use blake3::Hasher; +use thiserror::Error; +use warp_core::{ + make_head_id, make_node_id, make_type_id, make_warp_id, EngineBuilder, GraphStore, InboxPolicy, + NodeRecord, PlaybackMode, SchedulerKind, TrustedRuntimeHost, TrustedRuntimeWalConfig, + WorldlineId, WorldlineRuntime, WorldlineState, WriterHead, WriterHeadKey, +}; + +/// Stable failure category for opening a local Echo runtime host. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub enum RuntimeHostErrorKind { + /// The supplied configuration is not a valid bounded host description. + InvalidConfiguration, + /// The initial worldline could not be constructed or registered. + WorldlineBootstrap, + /// The trusted runtime host could not be constructed. + HostConstruction, + /// The configured WAL could not be activated or recovered. + WalActivation, +} + +/// Failure to construct or recover a sealed local Echo runtime host. +#[derive(Debug, Error)] +#[error("{kind:?}: {detail}")] +pub struct RuntimeHostError { + kind: RuntimeHostErrorKind, + detail: String, +} + +impl RuntimeHostError { + /// Returns the stable failure category. + #[must_use] + pub const fn kind(&self) -> RuntimeHostErrorKind { + self.kind + } +} + +/// Persistence posture for a local runtime host. +#[derive(Clone, Debug, Eq, PartialEq)] +pub enum RuntimeWal { + /// Ephemeral WAL retained only for the life of this process. + InMemory, + /// Filesystem WAL rooted at the supplied host-owned directory. + Filesystem(PathBuf), +} + +impl RuntimeWal { + /// Selects a filesystem-backed WAL directory. + #[must_use] + pub fn filesystem(path: impl AsRef) -> Self { + Self::Filesystem(path.as_ref().to_path_buf()) + } +} + +/// Explicit bootstrap description for one local runtime worldline. +#[derive(Clone, Debug, Eq, PartialEq)] +pub struct RuntimeHostConfig { + basis_label: String, + root_type_coordinate: String, + wal: RuntimeWal, +} + +impl RuntimeHostConfig { + /// Creates one bounded local runtime configuration. + /// + /// # Errors + /// + /// Returns [`RuntimeHostErrorKind::InvalidConfiguration`] when either + /// identity-bearing string is empty or exceeds 1,024 UTF-8 bytes. + pub fn new( + basis_label: impl Into, + root_type_coordinate: impl Into, + wal: RuntimeWal, + ) -> Result { + let basis_label = basis_label.into(); + let root_type_coordinate = root_type_coordinate.into(); + for (name, value) in [ + ("basis label", basis_label.as_str()), + ("root type coordinate", root_type_coordinate.as_str()), + ] { + if value.is_empty() || value.len() > 1_024 { + return Err(error( + RuntimeHostErrorKind::InvalidConfiguration, + format!("{name} must contain 1..=1024 UTF-8 bytes"), + )); + } + } + Ok(Self { + basis_label, + root_type_coordinate, + wal, + }) + } +} + +/// Read-only identity and state evidence for one opened host. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct RuntimeHostSnapshot { + worldline_id: [u8; 32], + state_root: [u8; 32], + pending_submission_count: usize, +} + +impl RuntimeHostSnapshot { + /// Returns the authoritative worldline identity. + #[must_use] + pub const fn worldline_id(&self) -> [u8; 32] { + self.worldline_id + } + + /// Returns the current worldline state root. + #[must_use] + pub const fn state_root(&self) -> [u8; 32] { + self.state_root + } + + /// Returns the count of accepted submissions awaiting settlement. + #[must_use] + pub const fn pending_submission_count(&self) -> usize { + self.pending_submission_count + } +} + +/// Sealed trusted runtime host. +/// +/// This wrapper intentionally exposes neither the underlying engine nor raw +/// runtime-owner constructors. +pub struct RuntimeHost { + inner: TrustedRuntimeHost, + worldline_id: WorldlineId, +} + +impl RuntimeHost { + /// Constructs a host, activates its WAL, and recovers retained runtime + /// history before returning. + /// + /// # Errors + /// + /// Returns a typed host error if bootstrap, construction, or WAL activation + /// fails. + pub fn open(config: RuntimeHostConfig) -> Result { + let lane_label = format!("echo:public-runtime:{}", config.basis_label); + let warp_id = make_warp_id(&lane_label); + let root_id = make_node_id(&format!("{lane_label}:root")); + let mut store = GraphStore::new(warp_id); + store.insert_node( + root_id, + NodeRecord { + ty: make_type_id(&config.root_type_coordinate), + }, + ); + let state = WorldlineState::from_root_store(store, root_id).map_err(|failure| { + error( + RuntimeHostErrorKind::WorldlineBootstrap, + failure.to_string(), + ) + })?; + let worldline_id = WorldlineId::from_bytes(domain_hash( + b"echo:public-runtime-worldline:v1\0", + config.basis_label.as_bytes(), + )); + let head = WriterHeadKey { + worldline_id, + head_id: make_head_id(&format!("{lane_label}:head")), + }; + let mut runtime = WorldlineRuntime::new(); + runtime + .register_worldline(worldline_id, state) + .map_err(|failure| { + error( + RuntimeHostErrorKind::WorldlineBootstrap, + failure.to_string(), + ) + })?; + runtime + .register_writer_head(WriterHead::with_routing( + head, + PlaybackMode::Play, + InboxPolicy::AcceptAll, + None, + true, + )) + .map_err(|failure| { + error( + RuntimeHostErrorKind::WorldlineBootstrap, + failure.to_string(), + ) + })?; + + let mut engine_store = GraphStore::default(); + let engine_root = make_node_id("echo:public-runtime-engine-root:v1"); + engine_store.insert_node( + engine_root, + NodeRecord { + ty: make_type_id("echo.public-runtime.engine-root/v1"), + }, + ); + let engine = EngineBuilder::new(engine_store, engine_root) + .scheduler(SchedulerKind::Radix) + .workers(1) + .build(); + let mut inner = TrustedRuntimeHost::new(runtime, engine).map_err(|failure| { + error(RuntimeHostErrorKind::HostConstruction, failure.to_string()) + })?; + let wal = match config.wal { + RuntimeWal::InMemory => TrustedRuntimeWalConfig::in_memory(), + RuntimeWal::Filesystem(root) => TrustedRuntimeWalConfig::filesystem(root), + }; + inner + .enable_runtime_wal(wal) + .map_err(|failure| error(RuntimeHostErrorKind::WalActivation, failure.to_string()))?; + Ok(Self { + inner, + worldline_id, + }) + } + + /// Returns read-only identity and state evidence for the opened host. + /// + /// # Errors + /// + /// Returns [`RuntimeHostErrorKind::WorldlineBootstrap`] if the configured + /// worldline is no longer available. + pub fn snapshot(&self) -> Result { + let frontier = self + .inner + .runtime() + .worldlines() + .get(&self.worldline_id) + .ok_or_else(|| { + error( + RuntimeHostErrorKind::WorldlineBootstrap, + "configured worldline is unavailable", + ) + })?; + Ok(RuntimeHostSnapshot { + worldline_id: *self.worldline_id.as_bytes(), + state_root: frontier.state().state_root(), + pending_submission_count: self.inner.runtime().pending_witnessed_submission_count(), + }) + } +} + +fn error(kind: RuntimeHostErrorKind, detail: impl Into) -> RuntimeHostError { + RuntimeHostError { + kind, + detail: detail.into(), + } +} + +fn domain_hash(domain: &[u8], bytes: &[u8]) -> [u8; 32] { + let mut hasher = Hasher::new(); + hasher.update(domain); + hasher.update(&(bytes.len() as u64).to_le_bytes()); + hasher.update(bytes); + hasher.finalize().into() +} diff --git a/crates/echo-runtime/tests/host_lifecycle.rs b/crates/echo-runtime/tests/host_lifecycle.rs new file mode 100644 index 00000000..79e14d64 --- /dev/null +++ b/crates/echo-runtime/tests/host_lifecycle.rs @@ -0,0 +1,47 @@ +// SPDX-License-Identifier: Apache-2.0 +// © James Ross Ω FLYING•ROBOTS +//! External-style lifecycle witnesses for the sealed runtime facade. + +use echo_runtime::{RuntimeHost, RuntimeHostConfig, RuntimeHostErrorKind, RuntimeWal}; + +#[test] +fn sealed_host_opens_without_native_rule_bootstrap() -> Result<(), Box> { + let config = RuntimeHostConfig::new( + "public-facade-test", + "examples.public-facade-root/v1", + RuntimeWal::InMemory, + )?; + let host = RuntimeHost::open(config)?; + let snapshot = host.snapshot()?; + + assert_ne!(snapshot.worldline_id(), [0; 32]); + assert_ne!(snapshot.state_root(), [0; 32]); + assert_eq!(snapshot.pending_submission_count(), 0); + Ok(()) +} + +#[test] +fn invalid_configuration_fails_before_host_construction() { + let outcome = RuntimeHostConfig::new("", "examples.root/v1", RuntimeWal::InMemory); + + assert!(matches!( + outcome, + Err(failure) if failure.kind() == RuntimeHostErrorKind::InvalidConfiguration + )); +} + +#[test] +fn filesystem_host_reopens_the_same_genesis_state() -> Result<(), Box> { + let wal = tempfile::tempdir()?; + let config = RuntimeHostConfig::new( + "filesystem-recovery-test", + "examples.filesystem-root/v1", + RuntimeWal::filesystem(wal.path()), + )?; + + let first = RuntimeHost::open(config.clone()).and_then(|host| host.snapshot())?; + let recovered = RuntimeHost::open(config).and_then(|host| host.snapshot())?; + + assert_eq!(recovered, first); + Ok(()) +} diff --git a/crates/warp-core/src/causal_anchor.rs b/crates/warp-core/src/causal_anchor.rs index ab98edf3..413060ec 100644 --- a/crates/warp-core/src/causal_anchor.rs +++ b/crates/warp-core/src/causal_anchor.rs @@ -835,10 +835,7 @@ impl CausalAnchorAdmissionReceipt { } } -#[cfg(any( - test, - all(feature = "native_rule_bootstrap", feature = "trusted_runtime") -))] +#[cfg(any(test, feature = "trusted_runtime"))] pub(crate) fn prepare_causal_anchor_admission( claim: CausalAnchorClaim, support_policy_digest: Hash, diff --git a/crates/warp-core/src/causal_wal.rs b/crates/warp-core/src/causal_wal.rs index 0c574e9b..2d22e0d6 100644 --- a/crates/warp-core/src/causal_wal.rs +++ b/crates/warp-core/src/causal_wal.rs @@ -38,10 +38,7 @@ use thiserror::Error; use crate::attachment::{AtomPayload, AttachmentValue}; use crate::braid::{BraidEvent, BraidStatus}; use crate::braid_shell::BraidMemberRef; -#[cfg(any( - test, - all(feature = "native_rule_bootstrap", feature = "trusted_runtime") -))] +#[cfg(any(test, feature = "trusted_runtime"))] use crate::causal_anchor::{prepare_causal_anchor_admission, CausalAnchorClaim}; use crate::causal_anchor::{ validate_causal_anchor_admission_evidence, CausalAnchorAdmissionReceipt, CausalAnchorError, @@ -1223,10 +1220,7 @@ impl WalTransactionBuilder { } /// Creates an admission-kernel-authorized causal-anchor transaction builder. - #[cfg(any( - test, - all(feature = "native_rule_bootstrap", feature = "trusted_runtime") - ))] + #[cfg(any(test, feature = "trusted_runtime"))] #[allow(clippy::too_many_arguments)] pub(crate) fn new_causal_anchor_admission( writer_epoch: WriterEpochId, @@ -2800,7 +2794,7 @@ pub(crate) fn decode_tick_receipt_records( } } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] pub(crate) fn tick_receipt_payload_is_batch(bytes: &[u8]) -> bool { bytes.starts_with(WAL_TICK_RECEIPT_BATCH_MAGIC_V3) } @@ -8707,7 +8701,7 @@ pub(crate) fn build_replayable_tick_batch_transaction( } /// Builds one runtime-owner installation transaction for exact executable meaning. -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] pub(crate) fn build_executable_operation_installation_transaction( mut builder: WalTransactionBuilder, retained_installation_bytes: Vec, @@ -8726,7 +8720,7 @@ pub(crate) fn build_executable_operation_installation_transaction( /// Its execution-kernel-owned state-delta record remains the replayable /// provenance carrier; the operation record carries the additional typed /// executable-semantics receipt. -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] pub(crate) fn build_executable_operation_tick_transaction( mut builder: WalTransactionBuilder, retained_execution_bytes: Vec, @@ -8766,10 +8760,7 @@ fn push_tick_receipt_records( } /// Builds one atomic Echo-owned causal-anchor admission transaction. -#[cfg(any( - test, - all(feature = "native_rule_bootstrap", feature = "trusted_runtime") -))] +#[cfg(any(test, feature = "trusted_runtime"))] pub(crate) fn build_causal_anchor_admission_transaction( mut builder: WalTransactionBuilder, claim: CausalAnchorClaim, @@ -8985,7 +8976,7 @@ pub struct RecoveredCausalAnchorAdmission { } impl RecoveredCausalAnchorAdmission { - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) const fn from_committed_wal_evidence( fact: CausalAnchorFact, receipt: CausalAnchorAdmissionReceipt, @@ -9004,10 +8995,7 @@ impl RecoveredCausalAnchorAdmission { } } - #[cfg(any( - test, - all(feature = "native_rule_bootstrap", feature = "trusted_runtime") - ))] + #[cfg(any(test, feature = "trusted_runtime"))] pub(crate) const fn from_observation(observation: ObservedCausalAnchorAdmission) -> Self { Self { observation } } @@ -9120,9 +9108,9 @@ pub fn observe_causal_anchor_admissions( #[derive(Clone, Debug)] pub(crate) struct ValidatedCausalAnchorHistory { pub(crate) admissions: Vec<(ObservedCausalAnchorAdmission, usize)>, - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) causal_history_frontiers: Vec, - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) causal_anchor_frontier_digest: Hash, } @@ -9138,7 +9126,7 @@ pub(crate) fn validate_recovered_causal_anchor_history( let mut admissions = Vec::new(); let mut current_frontier = causal_history_genesis_frontier_digest(); let mut current_causal_anchor_frontier = causal_anchor_genesis_frontier_digest(); - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] let mut frontiers = vec![CausalFrontierRef::from_digest(current_frontier)]; for (index, transaction) in report.transactions.iter().enumerate() { @@ -9148,7 +9136,7 @@ pub(crate) fn validate_recovered_causal_anchor_history( transaction.commit.transaction_kind, &transaction.frames, ); - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] let basis_after = CausalFrontierRef::from_digest(next_frontier); if transaction.commit.transaction_kind == WalTransactionKind::CausalAnchorAdmission { let admission = by_transaction @@ -9189,15 +9177,15 @@ pub(crate) fn validate_recovered_causal_anchor_history( admissions.push((admission, index)); } current_frontier = next_frontier; - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] frontiers.push(basis_after); } Ok(ValidatedCausalAnchorHistory { admissions, - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] causal_history_frontiers: frontiers, - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] causal_anchor_frontier_digest: current_causal_anchor_frontier, }) } diff --git a/crates/warp-core/src/contract_host.rs b/crates/warp-core/src/contract_host.rs index 447947b6..1391bf6e 100644 --- a/crates/warp-core/src/contract_host.rs +++ b/crates/warp-core/src/contract_host.rs @@ -21,7 +21,7 @@ pub(crate) fn decode_canonical_eint(bytes: &[u8]) -> Option<(u32, &[u8])> { } /// Encodes one canonical EINT envelope at the contract-host serialization boundary. -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] pub(crate) fn encode_canonical_eint(op_id: u32, vars_bytes: &[u8]) -> Option> { echo_wasm_abi::pack_intent_v1(op_id, vars_bytes).ok() } diff --git a/crates/warp-core/src/contract_obstruction.rs b/crates/warp-core/src/contract_obstruction.rs index 75fa6d99..5bb894a7 100644 --- a/crates/warp-core/src/contract_obstruction.rs +++ b/crates/warp-core/src/contract_obstruction.rs @@ -228,7 +228,7 @@ impl ContractObstruction { submission_id: *submission_id, }, ), - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] RuntimeError::EchoOperationCommit(_) | RuntimeError::EchoOperationActionAdmissionMissing(_) | RuntimeError::EchoOperationActionRequiresRuntimeWalAck => { diff --git a/crates/warp-core/src/contract_registry.rs b/crates/warp-core/src/contract_registry.rs index 73fac562..31744b98 100644 --- a/crates/warp-core/src/contract_registry.rs +++ b/crates/warp-core/src/contract_registry.rs @@ -6,7 +6,7 @@ //! read-only inverse laws, and query observers without importing application //! nouns into core. -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] use std::collections::BTreeSet; use echo_registry_api::{ @@ -15,9 +15,9 @@ use echo_registry_api::{ }; use thiserror::Error; -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] use blake3::Hasher; -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] use echo_registry_api::verify_contract_artifact; use crate::ident::Hash; @@ -25,7 +25,7 @@ use crate::observation::ContractQueryObserver; use crate::rule::RewriteRule; use crate::ContractInverseHandler; -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] const INSTALLED_CONTRACT_PACKAGE_ID_DOMAIN: &[u8] = b"echo:installed-contract-package-id:v1\0"; /// Deterministic identity for an installed generated contract package. @@ -363,7 +363,7 @@ pub enum InstalledContractPackageError<'a> { } /// Validated package installation plan. -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] pub(crate) struct PreparedInstalledContractPackage { pub(crate) record: InstalledContractPackageRecord, pub(crate) mutation_handlers: Vec, @@ -371,7 +371,7 @@ pub(crate) struct PreparedInstalledContractPackage { pub(crate) query_observers: Vec, } -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] pub(crate) fn prepare_installed_contract_package( package: InstalledContractPackage<'_>, ) -> Result> { @@ -424,8 +424,10 @@ pub(crate) fn prepare_installed_contract_package( rule_id: handler.rule.id, }); } - if matches!(handler.rule.conflict_policy, crate::ConflictPolicy::Join) - && handler.rule.join_fn.is_none() + if matches!( + handler.rule.conflict_policy, + crate::rule::ConflictPolicy::Join + ) && handler.rule.join_fn.is_none() { return Err(InstalledContractPackageError::MissingJoinFn); } @@ -514,7 +516,7 @@ pub(crate) fn prepare_installed_contract_package( }) } -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] fn validate_identity( identity: ContractPackageIdentity<'_>, ) -> Result<(), InstalledContractPackageError<'_>> { @@ -530,7 +532,7 @@ fn validate_identity( Ok(()) } -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] fn generated_contract_rule_op_id(rule_name: &str) -> Option { let mut parts = rule_name.split('/'); if parts.next()? != "cmd" { @@ -548,7 +550,7 @@ fn generated_contract_rule_op_id(rule_name: &str) -> Option { Some(op_id) } -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] fn installed_contract_package_id( identity: ContractPackageIdentity<'_>, registry_info: RegistryInfo, @@ -564,7 +566,7 @@ fn installed_contract_package_id( InstalledContractPackageId::from_bytes(hasher.finalize().into()) } -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] fn push_len_prefixed(hasher: &mut Hasher, bytes: &[u8]) { hasher.update(&(bytes.len() as u64).to_le_bytes()); hasher.update(bytes); diff --git a/crates/warp-core/src/coordinator.rs b/crates/warp-core/src/coordinator.rs index 27054cc4..54526eec 100644 --- a/crates/warp-core/src/coordinator.rs +++ b/crates/warp-core/src/coordinator.rs @@ -11,7 +11,7 @@ use std::panic::{catch_unwind, resume_unwind, AssertUnwindSafe}; use thiserror::Error; use crate::clock::{GlobalTick, WorldlineTick}; -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] use crate::echo_operation::{ AdmittedEchoOperationInvocationV1, EchoOperationActionOutcomeV1, EchoOperationApplicationBasisV1, EchoOperationCommitErrorV1, @@ -22,7 +22,7 @@ use crate::engine_impl::{CommitOutcome, Engine, EngineError}; use crate::head::{ HeadEligibility, PlaybackHeadRegistry, RunnableWriterSet, WriterHead, WriterHeadKey, }; -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] use crate::head_inbox::IngressPayload; use crate::head_inbox::{ InboxAddress, InboxIngestResult, IngressCausalParent, IngressEnvelope, IngressTarget, @@ -45,18 +45,18 @@ use crate::worldline_registry::WorldlineRegistry; use crate::worldline_state::{WorldlineFrontier, WorldlineState}; use crate::CausalTickReceiptRef; -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] const INSTALLED_CONTRACT_EINT_INTENT_KIND_LABEL: &str = "echo.intent/eint-v1"; -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] type SchedulerOperationOutcomeV1 = (Hash, EchoOperationActionOutcomeV1); -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] type SchedulerOperationOutcomesV1 = Vec; -#[cfg(not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")))] +#[cfg(not(feature = "trusted_runtime"))] type SchedulerOperationOutcomeV1 = (); -#[cfg(not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")))] +#[cfg(not(feature = "trusted_runtime"))] type SchedulerOperationOutcomesV1 = Vec; -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] pub(crate) fn resolve_echo_operation_evaluation_basis_v1( runtime: &WorldlineRuntime, provenance: &ProvenanceService, @@ -140,7 +140,7 @@ pub enum RuntimeError { ContractInverseTargetRequiresContractAdmission, /// A WAL-enabled host received an executable-operation Action through the /// non-durable app submission method. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] #[error( "executable-operation Actions on a WAL-enabled host require submit_intent_with_runtime_wal_ack" )] @@ -150,12 +150,12 @@ pub enum RuntimeError { Engine(#[from] EngineError), /// A scheduler-owned executable-operation Action batch could not be /// constructed. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] #[error(transparent)] EchoOperationCommit(#[from] EchoOperationCommitErrorV1), /// The scheduler selected a reserved executable Action without the /// runtime-owned admission token that authorizes evaluation. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] #[error("executable-operation Action admission is unavailable for ingress {0:?}")] EchoOperationActionAdmissionMissing(Hash), /// Provenance append or lookup failed during a runtime step. @@ -1402,7 +1402,7 @@ impl WorldlineRuntime { } /// Iterates only undecided witnessed submissions in deterministic id order. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn pending_witnessed_submissions( &self, ) -> impl Iterator { @@ -1411,7 +1411,7 @@ impl WorldlineRuntime { .filter_map(|submission_id| self.witnessed_submissions.get(submission_id)) } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn witnessed_submission_id_for_target( &self, head_key: WriterHeadKey, @@ -1625,7 +1625,7 @@ impl WorldlineRuntime { self.submit_intent(envelope).map(Into::into) } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn submit_contract_inverse_intent( &mut self, envelope: IngressEnvelope, @@ -1812,14 +1812,14 @@ impl WorldlineRuntime { })?; receipt.entries().get(index).map(|entry| (index, entry)) }; - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] let is_echo_operation_action = self .witnessed_submission_envelopes .get(&correlation.submission_id) .is_some_and(|envelope| { crate::echo_operation::echo_operation_action_invocation_bytes_v1(envelope).is_some() }); - #[cfg(not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")))] + #[cfg(not(feature = "trusted_runtime"))] let is_echo_operation_action = false; let candidate = if let Some(provider) = correlation .contract @@ -2650,7 +2650,7 @@ impl WorldlineRuntime { /// The opaque admission digest is derived by the trusted runtime owner from /// exact installed meaning and invocation-admission evidence. No contract /// callback evidence is attached to this ingress category. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn ingest_echo_operation_action_v1( &mut self, _authority: &TicketedRuntimeIngressAuthority, @@ -2736,7 +2736,7 @@ impl WorldlineRuntime { /// Returns an error when the envelope is not a canonical EINT local intent, /// no installed contract package supports its mutation operation id, or the /// underlying ticketed ingress boundary rejects the submission. - #[cfg(feature = "native_rule_bootstrap")] + #[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] pub fn ingest_installed_contract_invocation( &mut self, _authority: &TicketedRuntimeIngressAuthority, @@ -2767,7 +2767,7 @@ impl WorldlineRuntime { /// /// Returns an error for malformed EINT, unsupported provider mutations, or /// rejection by the shared ticketed-ingress boundary. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub fn ingest_provider_contract_invocation_v1( &mut self, _authority: &TicketedRuntimeIngressAuthority, @@ -2795,7 +2795,7 @@ impl WorldlineRuntime { /// This crate-private seam prevents application adapters from manufacturing /// Echo admission authority while preserving the installed-package evidence /// checks performed by the normal generated-contract path. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn ingest_host_admitted_installed_contract_invocation( &mut self, _authority: &TicketedRuntimeIngressAuthority, @@ -2818,7 +2818,7 @@ impl WorldlineRuntime { } /// Stages provider-native work using trusted-host-derived admission evidence. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn ingest_host_admitted_provider_contract_invocation_v1( &mut self, _authority: &TicketedRuntimeIngressAuthority, @@ -3210,7 +3210,7 @@ fn derive_ticketed_runtime_ingress_id( hasher.finalize().into() } -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] pub(crate) fn installed_contract_mutation_op_id( envelope: &IngressEnvelope, ) -> Result { @@ -3274,7 +3274,7 @@ fn scheduler_fault_scope_for_error( RuntimeError::Engine(_) | RuntimeError::FrontierTickOverflow(_) => { SchedulerFaultScope::Head(head_key) } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] RuntimeError::EchoOperationCommit(_) => SchedulerFaultScope::Head(head_key), RuntimeError::Provenance(_) | RuntimeError::UnknownHead(_) @@ -3308,7 +3308,7 @@ fn scheduler_fault_scope_for_error( | RuntimeError::TicketedIngressDuplicateRuntimeIngress { .. } => { SchedulerFaultScope::Runtime } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] RuntimeError::EchoOperationActionAdmissionMissing(_) | RuntimeError::EchoOperationActionRequiresRuntimeWalAck => SchedulerFaultScope::Runtime, } @@ -3951,17 +3951,17 @@ fn scheduler_error_cause_digest(err: &RuntimeError) -> Hash { } } } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] RuntimeError::EchoOperationCommit(error) => { hasher.update(b"echo-operation-commit"); hasher.update(error.to_string().as_bytes()); } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] RuntimeError::EchoOperationActionAdmissionMissing(ingress_id) => { hasher.update(b"echo-operation-action-admission-missing"); hasher.update(ingress_id); } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] RuntimeError::EchoOperationActionRequiresRuntimeWalAck => { hasher.update(b"echo-operation-action-requires-runtime-wal-ack"); } @@ -4174,7 +4174,7 @@ impl SchedulerCoordinator { /// Executes one scheduler pass with runtime-admitted executable-operation /// Actions available to Tick construction. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn super_tick_with_echo_operation_actions_v1( runtime: &mut WorldlineRuntime, provenance: &mut ProvenanceService, @@ -4201,13 +4201,11 @@ impl SchedulerCoordinator { runtime: &mut WorldlineRuntime, provenance: &mut ProvenanceService, engine: &mut Engine, - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] - operation_actions: Option<( + #[cfg(feature = "trusted_runtime")] operation_actions: Option<( &BTreeMap, &EchoOperationEvaluationAuthorityV1, )>, - #[cfg(not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")))] - _operation_actions: Option<()>, + #[cfg(not(feature = "trusted_runtime"))] _operation_actions: Option<()>, ) -> Result< ( Vec, @@ -4222,9 +4220,9 @@ impl SchedulerCoordinator { runtime.refresh_runnable(); let mut records = Vec::new(); - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] let mut operation_outcomes = Vec::new(); - #[cfg(not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")))] + #[cfg(not(feature = "trusted_runtime"))] let operation_outcomes = Vec::new(); let mut committed_correlations = Vec::new(); let keys: Vec = runtime.runnable.iter().copied().collect(); @@ -4265,13 +4263,13 @@ impl SchedulerCoordinator { provenance.checkpoint_for(keys.iter().map(|key| key.worldline_id))?; for key in &keys { - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] let partition_parent_global_tick = runtime.global_tick; let inbox = runtime .heads .inbox_mut(key) .ok_or(RuntimeError::UnknownHead(*key))?; - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] let admitted = if operation_actions.is_some() { inbox.admit_partitioned( crate::echo_operation::echo_operation_action_intent_kind_v1(), @@ -4281,7 +4279,7 @@ impl SchedulerCoordinator { } else { inbox.admit() }; - #[cfg(not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")))] + #[cfg(not(feature = "trusted_runtime"))] let admitted = inbox.admit(); if admitted.is_empty() { @@ -4296,7 +4294,7 @@ impl SchedulerCoordinator { .frontier_tick(); let parents = provenance.tip_ref(key.worldline_id)?.into_iter().collect(); - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] // `HeadInbox::admit_partitioned` guarantees that one admitted // batch contains either executable-operation Actions or // non-Action work, never both. Inspecting the first member is @@ -4305,7 +4303,7 @@ impl SchedulerCoordinator { crate::echo_operation::echo_operation_action_invocation_bytes_v1(envelope) .is_some() }); - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] let (snapshot, patch, receipt) = if executable_action_batch { #[cfg(any(test, feature = "host_test"))] if runtime.take_echo_operation_action_tick_construction_failure_for_test() { @@ -4388,7 +4386,7 @@ impl SchedulerCoordinator { }; (snapshot, patch, receipt) }; - #[cfg(not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")))] + #[cfg(not(feature = "trusted_runtime"))] let CommitOutcome { snapshot, patch, diff --git a/crates/warp-core/src/engine_impl.rs b/crates/warp-core/src/engine_impl.rs index fa382e88..569575d1 100644 --- a/crates/warp-core/src/engine_impl.rs +++ b/crates/warp-core/src/engine_impl.rs @@ -7,7 +7,7 @@ use blake3::Hasher; use thiserror::Error; use crate::attachment::{AttachmentKey, AttachmentValue}; -#[cfg(feature = "native_rule_bootstrap")] +#[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] use crate::contract_registry::{ prepare_installed_contract_package, ContractMutationHandler, InstalledContractPackage, InstalledContractPackageError, @@ -29,7 +29,7 @@ use crate::observation::ContractQueryObserver; #[cfg(any(test, feature = "delta_validate"))] use crate::parallel::merge_deltas; use crate::parallel::{build_work_units, execute_work_queue, ExecItem, WorkerResult, NUM_SHARDS}; -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] use crate::provider_contract::{ prepare_installed_provider_contract_package_v1, InstalledProviderContractPackageIdV1, InstalledProviderContractPackageRecordV1, ProviderContractInstallationError, @@ -441,18 +441,15 @@ pub struct Engine { installed_contract_packages: BTreeMap, installed_echo_operation_packages: BTreeMap, - #[cfg_attr( - not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")), - allow(dead_code) - )] + #[cfg_attr(not(feature = "trusted_runtime"), allow(dead_code))] installed_echo_operations_by_coordinate: BTreeMap, - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] installed_provider_contract_packages: BTreeMap, - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] installed_provider_contract_package_references: BTreeMap, - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] provider_contract_mutation_packages: BTreeMap, #[cfg_attr(not(feature = "native_rule_bootstrap"), allow(dead_code))] contract_mutation_handlers: BTreeMap, @@ -890,11 +887,11 @@ impl Engine { installed_contract_packages: BTreeMap::new(), installed_echo_operation_packages: BTreeMap::new(), installed_echo_operations_by_coordinate: BTreeMap::new(), - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] installed_provider_contract_packages: BTreeMap::new(), - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] installed_provider_contract_package_references: BTreeMap::new(), - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] provider_contract_mutation_packages: BTreeMap::new(), contract_mutation_handlers: BTreeMap::new(), contract_inverse_handlers: BTreeMap::new(), @@ -1092,11 +1089,11 @@ impl Engine { installed_contract_packages: BTreeMap::new(), installed_echo_operation_packages: BTreeMap::new(), installed_echo_operations_by_coordinate: BTreeMap::new(), - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] installed_provider_contract_packages: BTreeMap::new(), - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] installed_provider_contract_package_references: BTreeMap::new(), - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] provider_contract_mutation_packages: BTreeMap::new(), contract_mutation_handlers: BTreeMap::new(), contract_inverse_handlers: BTreeMap::new(), @@ -1183,7 +1180,7 @@ impl Engine { &mut self, observer: ContractQueryObserver, ) -> Result<(), EngineError> { - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] if self .provider_contract_mutation_packages .contains_key(&observer.query_id) @@ -1259,7 +1256,7 @@ impl Engine { /// Returns [`InstalledContractPackageError`] if registry verification fails, /// any handler/observer names an unsupported operation, or the package would /// conflict with an already-registered package, rule, mutation op, or query op. - #[cfg(feature = "native_rule_bootstrap")] + #[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] #[doc(hidden)] pub fn register_contract_package<'a>( &mut self, @@ -1299,10 +1296,7 @@ impl Engine { self.installed_echo_operation_packages.get(&package_id) } - #[cfg_attr( - not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")), - allow(dead_code) - )] + #[cfg_attr(not(feature = "trusted_runtime"), allow(dead_code))] pub(crate) fn preflight_recovered_echo_operation_packages_v1( &self, recovered: &[InstalledEchoOperationV1], @@ -1315,10 +1309,7 @@ impl Engine { Ok(()) } - #[cfg_attr( - not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")), - allow(dead_code) - )] + #[cfg_attr(not(feature = "trusted_runtime"), allow(dead_code))] pub(crate) fn restore_recovered_echo_operation_packages_v1( &mut self, recovered: &[InstalledEchoOperationV1], @@ -1333,10 +1324,7 @@ impl Engine { Ok(()) } - #[cfg_attr( - not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")), - allow(dead_code) - )] + #[cfg_attr(not(feature = "trusted_runtime"), allow(dead_code))] pub(crate) fn installed_echo_operation_packages_v1( &self, ) -> impl Iterator { @@ -1344,10 +1332,7 @@ impl Engine { } /// Returns the engine-owned policy id used by operation patches. - #[cfg_attr( - not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")), - allow(dead_code) - )] + #[cfg_attr(not(feature = "trusted_runtime"), allow(dead_code))] pub(crate) const fn echo_operation_policy_id(&self) -> u32 { self.policy_id } @@ -1365,7 +1350,7 @@ impl Engine { /// Returns a structured provider installation failure when preparation /// fails or any package root, operation, or scheduler rule conflicts with /// existing Engine-owned registry state. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn install_admitted_provider_contract_package_v1_trusted( &mut self, package_reference: ProviderPackageReferenceV1, @@ -1391,7 +1376,7 @@ impl Engine { Ok(prepared.record) } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] fn provider_contract_registration_error( error: EngineError, ) -> ProviderContractInstallationError { @@ -1418,7 +1403,7 @@ impl Engine { } } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] fn preflight_installed_provider_contract_package_v1( &self, record: &InstalledProviderContractPackageRecordV1, @@ -1493,7 +1478,7 @@ impl Engine { Ok(()) } - #[cfg(feature = "native_rule_bootstrap")] + #[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] fn installed_contract_registration_error<'a>( error: EngineError, ) -> InstalledContractPackageError<'a> { @@ -1517,7 +1502,7 @@ impl Engine { } } - #[cfg(feature = "native_rule_bootstrap")] + #[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] fn preflight_installed_contract_package<'a>( &self, record: &InstalledContractPackageRecord, @@ -1584,7 +1569,7 @@ impl Engine { } /// Returns the package id that installed a mutation operation id. - #[cfg(feature = "native_rule_bootstrap")] + #[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] #[must_use] pub fn installed_contract_mutation_package_id( &self, @@ -1594,7 +1579,7 @@ impl Engine { } /// Returns contract evidence for the installed package that owns a mutation op id. - #[cfg(feature = "native_rule_bootstrap")] + #[cfg(any(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] #[must_use] pub fn installed_contract_mutation_evidence( &self, @@ -1607,7 +1592,7 @@ impl Engine { } /// Returns the provider-native package id that installed a mutation operation. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] #[must_use] pub fn installed_provider_contract_mutation_package_id( &self, @@ -1619,7 +1604,7 @@ impl Engine { } /// Returns provider-native evidence for the installed package that owns a mutation. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] #[must_use] pub fn installed_provider_contract_mutation_evidence_v1( &self, @@ -1632,7 +1617,7 @@ impl Engine { } /// Returns one installed provider-native package by its deterministic id. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] #[must_use] pub fn installed_provider_contract_package( &self, @@ -1642,7 +1627,7 @@ impl Engine { } /// Returns the installed provider-native package for an exact package root. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] #[must_use] pub fn installed_provider_contract_package_by_reference( &self, @@ -1655,7 +1640,7 @@ impl Engine { } /// Returns the installed read-only inverse law for a mutation operation. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn installed_contract_inverse_handler( &self, op_id: u32, diff --git a/crates/warp-core/src/head_inbox.rs b/crates/warp-core/src/head_inbox.rs index 233ac05f..3220bb88 100644 --- a/crates/warp-core/src/head_inbox.rs +++ b/crates/warp-core/src/head_inbox.rs @@ -807,7 +807,7 @@ impl HeadInbox { /// heads advance one shared worldline. Recovery does not depend on /// process-local state. When only one category is pending, it proceeds /// immediately. Existing per-Tick limits still bound the selected category. - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn admit_partitioned( &mut self, partition_kind: IntentKind, @@ -987,7 +987,7 @@ mod tests { } } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] #[test] fn partitioned_admission_never_mixes_execution_categories() { let mut inbox = HeadInbox::new( @@ -1045,7 +1045,7 @@ mod tests { assert!(inbox.is_empty()); } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] #[test] fn homogeneous_unbounded_partitioned_admission_moves_the_whole_inbox() { let mut inbox = HeadInbox::new( @@ -1073,7 +1073,7 @@ mod tests { ); } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] #[test] fn scheduler_round_alternates_each_head_despite_even_worldline_progress() { let partition_kind = test_kind(); @@ -1122,7 +1122,7 @@ mod tests { } } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] #[test] fn partitioned_admission_applies_both_limit_directions_and_preserves_other_partition() { for (policy_limit, partition_limit, expected_partition_count) in @@ -1194,7 +1194,7 @@ mod tests { } } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] #[test] fn partitioned_admission_cannot_starve_other_category_by_ingress_hash() { let mut inbox = HeadInbox::new( diff --git a/crates/warp-core/src/lib.rs b/crates/warp-core/src/lib.rs index ade5e6b7..86a4e7f9 100644 --- a/crates/warp-core/src/lib.rs +++ b/crates/warp-core/src/lib.rs @@ -61,10 +61,7 @@ mod contract_registry; /// Domain separation prefixes for hashing. pub mod domain; mod dynamic_binding; -#[cfg_attr( - not(all(feature = "native_rule_bootstrap", feature = "trusted_runtime")), - allow(dead_code) -)] +#[cfg_attr(not(feature = "trusted_runtime"), allow(dead_code))] mod echo_operation; mod edict_target_ir; mod engine_impl; @@ -176,7 +173,7 @@ mod snapshot_accum; mod telemetry; mod tick_delta; mod tick_patch; -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] mod trusted_runtime_host; mod tx; #[cfg(not(target_arch = "wasm32"))] @@ -482,7 +479,7 @@ pub use tick_patch::{ slice_worldline_indices, PortalInit, SlotId, TickCommitStatus, TickPatchError, WarpOp, WarpOpKey, WarpTickPatchV1, }; -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] pub use trusted_runtime_host::{ EvidenceCatalogPosture, RuntimeWalActivationGap, TrustedRuntimeApp, TrustedRuntimeHost, TrustedRuntimeHostError, TrustedRuntimeHostParts, TrustedRuntimeHostRunReport, diff --git a/crates/warp-core/src/provider_contract.rs b/crates/warp-core/src/provider_contract.rs index 9792d5f0..42e2170d 100644 --- a/crates/warp-core/src/provider_contract.rs +++ b/crates/warp-core/src/provider_contract.rs @@ -17,7 +17,7 @@ use echo_registry_api::{ ProviderSemanticIdentityV1, ProviderValueContractV1, }; -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] use blake3::Hasher; use crate::contract_host::runtime_ingress_eint_read_footprint; @@ -28,7 +28,7 @@ use crate::ident::{make_type_id, NodeId}; use crate::rule::{ConflictPolicy, PatternGraph, RewriteRule}; use crate::TickDelta; -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] const INSTALLED_PROVIDER_CONTRACT_PACKAGE_ID_DOMAIN: &[u8] = b"echo:installed-provider-contract-package-id:v1\0"; @@ -303,7 +303,7 @@ pub struct ProviderContractAdmissionError { } impl ProviderContractAdmissionError { - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] fn new( kind: ProviderContractAdmissionErrorKind, subject: &'static str, @@ -316,7 +316,7 @@ impl ProviderContractAdmissionError { } } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] fn without_reference(kind: ProviderContractAdmissionErrorKind, subject: &'static str) -> Self { Self { kind, @@ -486,7 +486,7 @@ pub struct InstalledProviderContractPackageOccurrenceV1 { } impl InstalledProviderContractPackageOccurrenceV1 { - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] fn from_borrowed(value: ContractPackageIdentity<'_>) -> Self { Self { package_name: value.package_name.to_owned(), @@ -1010,7 +1010,7 @@ pub struct InstalledProviderMutationRuleIdentityV1 { } impl InstalledProviderMutationRuleIdentityV1 { - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] fn from_handler(handler: &ContractMutationHandler) -> Self { Self { operation_id: handler.op_id, @@ -1090,7 +1090,7 @@ impl InstalledProviderContractPackageRecordV1 { self.mutation_operation_ids.iter().copied() } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn mutation_evidence_v1( &self, operation_id: u32, @@ -1314,7 +1314,7 @@ pub struct ProviderContractInstallationError { } impl ProviderContractInstallationError { - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn new( kind: ProviderContractInstallationErrorKind, subject: impl Into, @@ -1327,7 +1327,7 @@ impl ProviderContractInstallationError { } } - #[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] + #[cfg(feature = "trusted_runtime")] pub(crate) fn without_reference( kind: ProviderContractInstallationErrorKind, subject: impl Into, @@ -1406,7 +1406,7 @@ pub trait ProviderContractPackageInstallerV1: SealedProviderContractPackageInsta } /// Provider-native installation material validated before Engine mutation. -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] pub(crate) struct PreparedInstalledProviderContractPackageV1 { pub(crate) record: InstalledProviderContractPackageRecordV1, pub(crate) mutation_handler: ContractMutationHandler, @@ -1419,7 +1419,7 @@ pub(crate) struct PreparedInstalledProviderContractPackageV1 { /// full admitted provider proposition, and derives a deterministic installed /// id. It does not authenticate bytes, invoke provider callbacks, or mutate /// Engine state. -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] pub(crate) fn prepare_installed_provider_contract_package_v1( package_reference: ProviderPackageReferenceV1, admitted: AdmittedProviderContractPackageV1<'_>, @@ -1557,7 +1557,7 @@ fn strict_prefixed_sha256(value: &str) -> Option<&str> { (is_raw_sha256(raw)).then_some(raw) } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] const fn provider_op_kind_label(kind: OpKind) -> &'static str { match kind { OpKind::Mutation => "mutation", @@ -1565,7 +1565,7 @@ const fn provider_op_kind_label(kind: OpKind) -> &'static str { } } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn installed_provider_contract_package_id_v1( package_reference: &ProviderPackageReferenceV1, occurrence: &InstalledProviderContractPackageOccurrenceV1, @@ -1594,7 +1594,7 @@ fn installed_provider_contract_package_id_v1( InstalledProviderContractPackageIdV1::from_bytes(hasher.finalize().into()) } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn hash_provider_operation(hasher: &mut Hasher, value: &InstalledProviderOperationV1) { hash_text(hasher, value.coordinate()); hash_text(hasher, value.semantic_domain()); @@ -1614,33 +1614,33 @@ fn hash_provider_operation(hasher: &mut Hasher, value: &InstalledProviderOperati hash_provider_footprint(hasher, value.footprint()); } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn hash_provider_digest(hasher: &mut Hasher, value: &InstalledProviderDigestIdentityV1) { hash_text(hasher, value.coordinate()); hash_text(hasher, value.digest_domain()); hash_text(hasher, value.digest()); } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn hash_provider_schema(hasher: &mut Hasher, value: &InstalledProviderSchemaIdentityV1) { hash_text(hasher, value.coordinate()); hash_text(hasher, value.raw_sha256_hex()); } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn hash_provider_semantic(hasher: &mut Hasher, value: &InstalledProviderSemanticIdentityV1) { hash_text(hasher, value.coordinate()); hash_text(hasher, value.semantic_domain()); } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn hash_provider_value_contract(hasher: &mut Hasher, value: &InstalledProviderValueContractV1) { hash_text(hasher, value.schema_coordinate()); hash_text(hasher, value.schema_domain()); hash_text(hasher, value.codec_id()); } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn hash_provider_bundle(hasher: &mut Hasher, value: &InstalledProviderBundleIdentityV1) { hash_text(hasher, value.semantic_digest_domain()); hash_text(hasher, value.semantic_digest()); @@ -1648,7 +1648,7 @@ fn hash_provider_bundle(hasher: &mut Hasher, value: &InstalledProviderBundleIden hash_text(hasher, value.release_digest()); } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn hash_provider_footprint(hasher: &mut Hasher, value: &InstalledProviderFootprintIdentityV1) { hash_text(hasher, value.obligation()); hash_text(hasher, value.algebra_coordinate()); @@ -1656,28 +1656,28 @@ fn hash_provider_footprint(hasher: &mut Hasher, value: &InstalledProviderFootpri hash_text(hasher, value.algebra_digest()); } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn hash_text(hasher: &mut Hasher, value: &str) { hash_bytes(hasher, value.as_bytes()); } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn hash_u32(hasher: &mut Hasher, value: u32) { hash_bytes(hasher, &value.to_le_bytes()); } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn hash_u64(hasher: &mut Hasher, value: u64) { hash_bytes(hasher, &value.to_le_bytes()); } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn hash_bytes(hasher: &mut Hasher, value: &[u8]) { hasher.update(&(value.len() as u64).to_le_bytes()); hasher.update(value); } -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] fn provider_operation_set_reference(operations: &[ProviderOperationV1<'_>]) -> String { if operations.is_empty() { return "".to_owned(); @@ -1695,7 +1695,7 @@ fn provider_operation_set_reference(operations: &[ProviderOperationV1<'_>]) -> S /// proposition before retaining the opaque proposal. It performs no registry, /// scheduler, filesystem, environment, process, clock, randomness, or network /// operation. -#[cfg(all(feature = "native_rule_bootstrap", feature = "trusted_runtime"))] +#[cfg(feature = "trusted_runtime")] pub(crate) fn admit_provider_contract_package_v1<'a>( policy: &ProviderContractAdmissionPolicyV1<'_>, proposal: ProviderContractPackageProposalV1<'a>, diff --git a/docs/topics/GeneratedRules.md b/docs/topics/GeneratedRules.md index 7c515471..d7f59d89 100644 --- a/docs/topics/GeneratedRules.md +++ b/docs/topics/GeneratedRules.md @@ -250,13 +250,17 @@ are deterministic self-validation. For descended targets, the retained footprint and patch inputs include every portal attachment in the validated root-to-target reachability chain. -The slice currently reuses `TrustedRuntimeHost`, whose module is exposed only -under the joint `native_rule_bootstrap` and `trusted_runtime` feature gate. That -compile-time coupling does not place a callback in the operation program, but -it prevents the maintenance runner from serving as the final product cutover -boundary. -The host/WAL shell must be separated from `native_rule_bootstrap` before Jedit -can delete the legacy feature without also losing executable operations. +The trusted host and WAL implementation now compile under `trusted_runtime` +without enabling `native_rule_bootstrap`. The unreleased +`flyingrobots-echo-runtime` crate proves a sealed public construction and WAL +recovery facade on that feature lane while exporting neither `RewriteRule` nor +`TrustedRuntimeHost`. + +This is the first release-boundary extraction, not the finished external host. +Package installation, submission, scheduling, typed outcomes, and receipts +still need bounded facade APIs and a clean external-host witness. The facade +therefore remains `publish = false`; `warp-core` and its trusted implementation +surface are not the recommended application API. ## Footprint Honesty diff --git a/docs/topics/RuntimeAuthority.md b/docs/topics/RuntimeAuthority.md index 98990590..70907c44 100644 --- a/docs/topics/RuntimeAuthority.md +++ b/docs/topics/RuntimeAuthority.md @@ -72,6 +72,15 @@ Applications receive submission and observation capabilities without those controls. Product nouns and product policy remain in application contracts and adapters. +The unreleased `echo_runtime::RuntimeHost` is the first sealed Rust facade over +that role. It can construct and recover a local host and WAL shell without +exposing the underlying engine, `TrustedRuntimeHost`, native rule registration, +or constructors for receipts, authority epochs, and committed outcomes. It does +not yet expose installation, submission, scheduling, result, or receipt APIs; +those remain required before an external host can prove the complete release +lifecycle. The crate remains `publish = false`, so this boundary is executable +release-engineering evidence rather than a published API promise. + ## Evidence Anchors - [Registry/provider/host boundary](../adr/0015-registry-provider-host-boundary.md) @@ -80,3 +89,4 @@ adapters. - `docs/architecture/application-contract-hosting.md` - `crates/warp-core/src/trusted_runtime_host.rs` - `crates/warp-core/src/engine_impl.rs` +- `crates/echo-runtime/src/lib.rs` diff --git a/scripts/verify-local.sh b/scripts/verify-local.sh index ef8fc503..8b755368 100755 --- a/scripts/verify-local.sh +++ b/scripts/verify-local.sh @@ -249,6 +249,31 @@ sha256_stream() { fi } +crate_package_name() { + local crate="$1" + local manifest="crates/${crate}/Cargo.toml" + local package_name + + package_name="$({ + awk ' + /^\[package\]$/ { in_package = 1; next } + in_package && /^\[/ { exit } + in_package && /^name[[:space:]]*=/ { + value = $0 + sub(/^[^=]*=[[:space:]]*"/, "", value) + sub(/"[[:space:]]*$/, "", value) + print value + exit + } + ' "$manifest" + } || true)" + if [[ -z "$package_name" ]]; then + echo "verify-local: missing [package] name in ${manifest}" >&2 + return 1 + fi + printf '%s\n' "$package_name" +} + SCRIPT_HASH="$(sha256_file "$0")" readonly FULL_CRITICAL_PREFIXES=( @@ -797,7 +822,7 @@ run_docs_lint() { run_targeted_checks() { local crates=("$@") - local crate + local crate package local rustdoc_crates=() if [[ ${#crates[@]} -eq 0 ]]; then @@ -820,8 +845,9 @@ run_targeted_checks() { done for crate in "${rustdoc_crates[@]}"; do + package="$(crate_package_name "$crate")" echo "[verify-local] rustdoc warnings gate (${crate})" - RUSTDOCFLAGS="-D warnings" cargo +"$PINNED" doc -p "$crate" --no-deps + RUSTDOCFLAGS="-D warnings" cargo +"$PINNED" doc -p "$package" --no-deps done fi @@ -829,14 +855,15 @@ run_targeted_checks() { if [[ ! -f "crates/${crate}/Cargo.toml" ]]; then continue fi + package="$(crate_package_name "$crate")" local -a test_args=() mapfile -t test_args < <(targeted_test_args_for_crate "$crate") if use_nextest; then - echo "[verify-local] cargo nextest run -p ${crate} ${test_args[*]}" - cargo +"$PINNED" nextest run -p "$crate" "${test_args[@]}" + echo "[verify-local] cargo nextest run -p ${package} ${test_args[*]}" + cargo +"$PINNED" nextest run -p "$package" "${test_args[@]}" else - echo "[verify-local] cargo test -p ${crate} ${test_args[*]}" - cargo +"$PINNED" test -p "$crate" "${test_args[@]}" + echo "[verify-local] cargo test -p ${package} ${test_args[*]}" + cargo +"$PINNED" test -p "$package" "${test_args[@]}" fi done @@ -847,19 +874,20 @@ run_crate_lint_and_check() { local scope="$1" shift local crates=("$@") - local crate + local crate package for crate in "${crates[@]}"; do if [[ ! -f "crates/${crate}/Cargo.toml" ]]; then echo "[verify-local] skipping ${crate}: missing crates/${crate}/Cargo.toml" >&2 continue fi + package="$(crate_package_name "$crate")" local -a clippy_args=() mapfile -t clippy_args < <(clippy_target_args_for_scope "$crate" "$scope") - echo "[verify-local] cargo clippy -p ${crate} ${clippy_args[*]}" - cargo +"$PINNED" clippy -p "$crate" "${clippy_args[@]}" -- -D warnings -D missing_docs - echo "[verify-local] cargo check -p ${crate}" - cargo +"$PINNED" check -p "$crate" --quiet + echo "[verify-local] cargo clippy -p ${package} ${clippy_args[*]}" + cargo +"$PINNED" clippy -p "$package" "${clippy_args[@]}" -- -D warnings -D missing_docs + echo "[verify-local] cargo check -p ${package}" + cargo +"$PINNED" check -p "$package" --quiet done } @@ -1277,39 +1305,40 @@ collect_pre_push_rust_slices() { run_pre_push_rust_slice() { local slice="$1" - local crate kind target features filter + local crate package kind target features filter IFS='|' read -r crate kind target features filter <<< "$slice" if [[ ! -f "crates/${crate}/Cargo.toml" ]]; then echo "[verify-local][pre-push] skipping ${crate}: missing crates/${crate}/Cargo.toml" >&2 return fi + package="$(crate_package_name "$crate")" local -a cargo_args=() case "$kind" in lib) - cargo_args=("test" "-p" "$crate") + cargo_args=("test" "-p" "$package") [[ -n "$features" ]] && cargo_args+=("--features" "$features") cargo_args+=("--lib") [[ -n "$filter" ]] && cargo_args+=("$filter") ;; test) - cargo_args=("test" "-p" "$crate") + cargo_args=("test" "-p" "$package") [[ -n "$features" ]] && cargo_args+=("--features" "$features") cargo_args+=("--test" "$target") ;; bins) - cargo_args=("test" "-p" "$crate") + cargo_args=("test" "-p" "$package") [[ -n "$features" ]] && cargo_args+=("--features" "$features") cargo_args+=("--bins") ;; bin) - cargo_args=("test" "-p" "$crate") + cargo_args=("test" "-p" "$package") [[ -n "$features" ]] && cargo_args+=("--features" "$features") cargo_args+=("--bin" "$target") ;; check) - cargo_args=("check" "-p" "$crate") + cargo_args=("check" "-p" "$package") [[ -n "$features" ]] && cargo_args+=("--features" "$features") cargo_args+=("--quiet") ;; @@ -2046,14 +2075,15 @@ run_ultra_fast_checks() { echo "[verify-local] cargo fmt --all -- --check" cargo +"$PINNED" fmt --all -- --check - local crate + local crate package for crate in "${changed_crates[@]}"; do if [[ ! -f "crates/${crate}/Cargo.toml" ]]; then echo "[verify-local] skipping ${crate}: missing crates/${crate}/Cargo.toml" >&2 continue fi - echo "[verify-local] cargo check -p ${crate}" - cargo +"$PINNED" check -p "$crate" --quiet + package="$(crate_package_name "$crate")" + echo "[verify-local] cargo check -p ${package}" + cargo +"$PINNED" check -p "$package" --quiet done if [[ "$classification" == "full" ]]; then From 1e631a9e9902d09f544acb3f1a2e6e909bf6b5c6 Mon Sep 17 00:00:00 2001 From: James Ross Date: Mon, 24 Aug 2026 08:51:23 -0700 Subject: [PATCH 2/2] Document public Echo release boundary --- AGENTS.md | 28 ++ docs/README.md | 2 + .../public-rust-release-boundary.md | 293 ++++++++++++++++++ docs/invariants/PUBLIC-RUNTIME-AUTHORITY.md | 43 +++ docs/topics/GeneratedRules.md | 6 + docs/topics/RuntimeAuthority.md | 24 ++ docs/topics/WAL.md | 15 + 7 files changed, 411 insertions(+) create mode 100644 docs/architecture/public-rust-release-boundary.md create mode 100644 docs/invariants/PUBLIC-RUNTIME-AUTHORITY.md diff --git a/AGENTS.md b/AGENTS.md index f47daf32..4c261f16 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -88,6 +88,34 @@ architecture document, follow any explicit links into the historical ADR archive, then inspect the current GitHub issue or pull request, `git log -n 5`, and `git status`. +## Durable Decision Discipline + +Important decisions are incomplete until their durable owner is current. +Architecture, authority, identity, canonical-format, recovery, compatibility, +ownership, public-API, and release-boundary decisions MUST be recorded in the +same change in the current document that owns the concept. Chat transcripts, +Think memories, pull-request prose, and review threads may explain or motivate +a decision, but they are not its canonical repository home. + +For every such decision: + +1. Name one canonical owner under `docs/architecture/`, `docs/spec/`, + `docs/invariants/`, or `docs/topics/` before completing the change. +2. Record the accepted rule, its current-versus-target posture, and explicit + refinement, supersession, dependency, and related-document edges. +3. Update `docs/README.md` or another relevant entrance when a durable page is + added, moved, or renamed. +4. Link to the canonical owner from reader-specific pages instead of copying + the same rule into several places. +5. Keep implementation checklists, review state, dates, and delivery status in + GitHub. Current docs define durable truth, not a second project tracker. +6. Revisit the same canonical owner whenever later work refines the decision. + A refinement is not complete while code, schemas, packages, or release + behavior disagree with the documented rule. + +Do not allocate a new numbered ADR. Treat missing or stale canonical decision +documentation as incomplete engineering work, not optional polish. + ## Work Loop ```text diff --git a/docs/README.md b/docs/README.md index 196a6ae6..fd33dc3e 100644 --- a/docs/README.md +++ b/docs/README.md @@ -11,6 +11,7 @@ causal history. Git history is the archive; GitHub owns live work and status. - [Documentation standards](DOCUMENTATION_STANDARDS.md) - [Architecture outline](architecture/outline.md) - [Application contract hosting](architecture/application-contract-hosting.md) +- [Public Rust release boundary](architecture/public-rust-release-boundary.md) - [Local contract host quickstart](quickstart-local-contract-host.md) - [Echo 1.0 release contract](releases/echo-1.0-contract.md) - [WARP core runtime](spec/warp-core.md) @@ -75,6 +76,7 @@ relationships. - [Strand contract](invariants/STRAND-CONTRACT.md) - [Fixed timestep](invariants/FIXED-TIMESTEP.md) - [Declarative rule authorship](invariants/DECLARATIVE-RULE-AUTHORSHIP.md) +- [Public runtime authority](invariants/PUBLIC-RUNTIME-AUTHORITY.md) ## Determinism Evidence diff --git a/docs/architecture/public-rust-release-boundary.md b/docs/architecture/public-rust-release-boundary.md new file mode 100644 index 00000000..4ba253c1 --- /dev/null +++ b/docs/architecture/public-rust-release-boundary.md @@ -0,0 +1,293 @@ + + + +# Public Rust Release Boundary + +Status: accepted target architecture. The sealed `echo_runtime::RuntimeHost` +construction and recovery witness exists, but the crate decomposition and +public alpha release closure described here are not yet complete or published. + +This page owns Echo's public Rust package boundary for the first alpha release. +It defines which responsibilities may cross Cargo package boundaries, which +authority must remain private, and what evidence is required before a public +release may be proposed. + +## Core Rule + +Pure computation and passive storage contracts may cross published Cargo +package boundaries. Authority-minting machinery stays private inside +`flyingrobots-echo-runtime`. + +Rust has no friend-crate visibility. If a separately published implementation +crate exposes a `pub` constructor so the runtime facade can call it, every +downstream crate can call it. Documentation, hidden re-exports, package posture, +and feature conventions do not repair that authority leak. + +Echo therefore distinguishes two categories: + +```text +constructible claim + passive bytes, candidate material, storage observations + +admitted history + runtime-validated authority, settlement, and recovery truth +``` + +Constructing claim-shaped bytes never makes them authoritative Echo history. + +## Target Package Topology + +The first public release closure has this dependency shape: + +```text +flyingrobots-echo-protocol + | + +--> flyingrobots-echo-kernel + | + +--> flyingrobots-echo-wal + | +protocol + kernel + wal + | + v + flyingrobots-echo-runtime +``` + +### `flyingrobots-echo-protocol` + +This package owns passive canonical contracts shared across layers: + +- artifact, package, realm, epoch, event, reading, outcome, and evidence + coordinates; +- authority-, budget-, effect-, release-, and schema-profile references; +- candidate and observed durable-record schemas; +- canonical codecs whose meaning is independently specified; +- typed refusal and fault classifications. + +It MUST remain passive. A public caller may construct a protocol claim, but the +package MUST NOT grant runtime authority or declare that a claim committed. + +### `flyingrobots-echo-kernel` + +This package owns deterministic candidate computation from explicit admitted +inputs and bases: + +- graph records and attachments; +- footprints, independence, and conflict calculations; +- candidate patches and snapshot calculations; +- pure validation and deterministic scheduling structures; +- pure application of candidate state transitions. + +The kernel performs no persistence, external effects, runtime admission, or +durable settlement. Its output remains candidate material until the runtime +admits it at the serialization boundary. + +### `flyingrobots-echo-wal` + +This package owns persistence mechanism and storage observations: + +- framing, checksums, and LSN continuity; +- retained storage implementations; +- scanning, tail classification, and recovery observations; +- persistence of encoded fencing material. + +It may say that bytes were stored, frames scanned, checksums validated, or a +token value was observed. It MUST NOT independently say that a writer was +lawfully authorized, an epoch is authoritative, a candidate committed, a +causal receipt exists, or recovery was accepted. Those conclusions belong to +the runtime after complete validation. + +For the first alpha, the WAL package exposes only Echo-retained implementations +whose behavioral guarantees are tested and included in the release closure. +Arbitrary third-party durable backends are deferred until Echo has a provider +guarantee and admission protocol. Implementing a Rust trait is not proof of +`fsync`, fencing, crash atomicity, or durable ordering. + +### `flyingrobots-echo-runtime` + +This package owns both the sealed public host facade and all authority-bearing +runtime machinery behind private modules. It privately controls: + +- authority-realm and epoch construction; +- admission-token construction; +- package correlation and admission; +- candidate serialization and Tick construction; +- settlement and receipt construction; +- committed-state publication; +- recovery validation and acceptance. + +The public facade accepts evidence-bearing requests and returns opaque handles, +readings, or typed outcomes. A caller requests work. Echo decides whether +lawful history exists afterward. + +The API vocabulary MUST preserve the distinction among verification, +correlation, admission, execution, and settlement. Unless the runtime actually +executes the verifier, use operations shaped like: + +```text +correlate_verified_subject +-> admit_and_install_package +-> submit +-> run_until_idle +-> observe_outcome / read_receipt +``` + +Do not collapse those steps into `verify_and_install_package`. + +## Authority Must Not Escape Through Rust APIs + +Private constructors are necessary but insufficient. Public admitted types +MUST also refuse indirect construction paths that would let a downstream crate +forge runtime truth, including: + +- `Deserialize`, `Default`, or public fields and enum variants; +- `From` or `TryFrom` conversions from passive records or bytes; +- unchecked builders or raw reconstruction helpers; +- `Clone`, `Copy`, or mutable interior access where duplication or mutation + would mint authority; +- test, fault-injection, compatibility, or unsafe constructors exposed through + a published feature. + +Opaque readings may expose identifiers, outcomes, and canonical evidence bytes. +Canonical bytes are evidence for corroboration; they are not a public inverse +constructor for an admitted runtime value. + +Every `Send`, `Sync`, `Clone`, serialization, conversion, and borrowing +implementation on an authority-bearing public type requires an explicit +authority audit. + +## Feature Surface Is Part of the Security Boundary + +Every feature declared by a published Echo package, alone and in every +selectable combination, MUST remain authority-safe. The release closure may +enumerate behaviorally supported and tested configurations, but omission from +that list is not access control. + +Published manifests MUST NOT contain dormant authority escape hatches such as: + +```text +native_rule_bootstrap +host_test +raw_authority +trusted_runtime_internals +receipt_construction +fault_injection +``` + +Compatibility bootstrap, host-test authority, fault injection, and repository +fixtures belong behind `cfg(test)` or in `publish = false` packages. + +## Compatibility and Legacy Packages + +`warp-core` remains a temporary, `publish = false` compatibility monolith while +the public route is strangled out of it. It is not part of the preferred public +runtime closure and does not need a public-looking intermediate rename. + +`flyingrobots-echo-native-bootstrap` is the intended name for any retained +compatibility/test lane once extracted. It remains `publish = false` and MUST +NOT enter the public runtime dependency or feature closure. Repository `xtask`, +`host_test`, and fault-injection packages are likewise excluded. + +The first alpha does not publish a separate authority-bearing +`flyingrobots-echo-runtime-core`. Such a package is permissible later only when +every public inter-package API it requires is safe for arbitrary downstream +callers. + +## Cargo Package Namespace + +Every durable, reusable, or release-relevant Cargo package semantically owned +by Echo uses the `flyingrobots-echo-*` package prefix. Rust library names may +use conventional underscore names, and installed binaries may use product +names such as `echo` or `echod`. + +Semantic ownership outranks repository location. A product-neutral library or +a package owned by Git WARP, Continuum, or another sibling system MUST NOT gain +the Echo prefix merely because it currently lives in this repository. + +Repository orchestration and disposable fixtures may retain local conventional +names. `warp-core` is an explicit temporary legacy exception whose exception +ends when the public runtime no longer depends on it and its remaining +responsibilities have owners. + +## Release Witness and Closure + +The public boundary is proven by a clean-room consumer outside the Echo +workspace. `hello-echo-release-host` must consume packaged `.crate` archives +and the exact provider bundle, with no sibling worktrees or repository tooling, +and prove: + +```text +release-closure corroboration +-> package evidence correlation and admission +-> submission and scheduling +-> settlement and receipt observation +-> clean shutdown +-> WAL restart +-> recovery of the same settlement +``` + +Negative clean-room witnesses must also prove that downstream code cannot: + +- construct a Tick, receipt, authority epoch, or admission token; +- mutate private runtime registries or append authoritative history directly; +- enable any packaged feature combination that imports `warp-core`, native + bootstrap, host-test authority, or fault injection. + +The `EchoReleaseClosureId` binds the compatible crate archives and checksums, +Cargo dependency closure, runtime semantic and implementation identities, +profiles and ABIs, provider artifacts, target profile, schemas/codecs, and +release evidence. Individually authentic children from different release +closures do not form a valid Echo release. + +Crates.io is a distribution and discovery mirror, not historical retention +authority. Release engineering, packaging, dry runs, and clean-room validation +are reversible work. Publishing crates, reserving names, changing ownership, +creating release tags, dispatching publish-capable workflows, or representing a +public release requires separate explicit human authorization. + +## Alpha Exit Conditions + +Echo is ready to propose its first public Rust alpha only when: + +- `flyingrobots-echo-runtime` no longer depends on `warp-core`; +- the public package and feature closure excludes native bootstrap, host-test + authority, fault injection, `xtask`, and raw authority constructors; +- protocol, kernel, and WAL dependencies point downward without cycles; +- all packaged feature combinations pass the authority-surface audit; +- the external clean-room host packages, executes, restarts, and recovers; +- the exact provider bundle and Cargo dependency closure are bound by one + retained release-closure identity; +- all package dry runs and evidence generation have completed without any + publication side effect. + +## Current Posture + +The unreleased `echo_runtime::RuntimeHost` proves that a sealed facade can own +host and WAL construction plus recovery without exposing the underlying +engine, native bootstrap, or trusted host. It does not yet provide the complete +external lifecycle, and its package remains `publish = false`. + +The present repository still routes significant runtime work through +`warp-core`, and the Hello Echo route still relies on repository orchestration. +Those facts make this page a target boundary with an executable first witness, +not a claim that the alpha crate closure already exists. + +## Relationships + +- Depends on [Runtime authority](../topics/RuntimeAuthority.md). +- Depends on [WAL](../topics/WAL.md). +- Constrains [Generated rule authorship](../topics/GeneratedRules.md). +- Refines the public-host portion of + [Application contract hosting](application-contract-hosting.md). +- Refines the retained registry/provider/host boundary in + [ADR 0015](../adr/0015-registry-provider-host-boundary.md). +- Contributes to the [Echo 1.0 release contract](../releases/echo-1.0-contract.md) + without claiming that contract complete. + +## Evidence Anchors + +- `crates/echo-runtime/src/lib.rs` +- `crates/echo-runtime/Cargo.toml` +- `crates/warp-core/src/trusted_runtime_host.rs` +- `crates/warp-core/src/engine_impl.rs` +- `xtask/src/run_edict_operation.rs` +- `scripts/verify-local.sh` diff --git a/docs/invariants/PUBLIC-RUNTIME-AUTHORITY.md b/docs/invariants/PUBLIC-RUNTIME-AUTHORITY.md new file mode 100644 index 00000000..00e63468 --- /dev/null +++ b/docs/invariants/PUBLIC-RUNTIME-AUTHORITY.md @@ -0,0 +1,43 @@ + + + +# Public Runtime Authority + +This invariant governs every Cargo package and feature combination admitted to +Echo's public Rust release closure. + +1. Constructible passive material is not admitted Echo history. +2. Pure computation and passive storage contracts MAY cross published package + boundaries. +3. Authority epochs, admission tokens, Tick construction, settlement, receipt + construction, commit publication, and recovery acceptance MUST remain + private inside `flyingrobots-echo-runtime`. +4. No public constructor, field, enum variant, deserializer, default, + conversion, unchecked builder, clone path, test feature, or unsafe helper may + forge an admitted runtime value. +5. Every selectable feature combination in a published package MUST remain + authority-safe, whether or not the release closure lists it as supported. +6. Published runtime packages MUST NOT expose or depend on native bootstrap, + host-test authority, fault injection, repository orchestration, or the + legacy `warp-core` route. +7. WAL code MAY report mechanical storage observations. Only the runtime may + admit those observations as authoritative history or accepted recovery. +8. The first alpha MUST use a closed set of retained WAL implementations. + Third-party durability claims require a separate provider guarantee and + admission protocol. +9. Verification evidence is a claim about an executable subject. Runtime + admission is a separate authority decision. API names and types MUST preserve + that distinction. +10. Every durable, reusable, release-relevant Echo-owned Cargo package MUST use + the `flyingrobots-echo-*` package prefix. Repository location alone does not + establish semantic ownership. +11. The public release boundary MUST be proven from packaged artifacts by both + a positive clean-room lifecycle witness and negative authority-escape + witnesses. +12. Release engineering does not authorize publication. Registry publication, + namespace reservation, ownership changes, release tags, and publish-capable + workflow dispatch require separate explicit human approval. + +The complete rationale, target package topology, and current implementation +posture live in +[Public Rust release boundary](../architecture/public-rust-release-boundary.md). diff --git a/docs/topics/GeneratedRules.md b/docs/topics/GeneratedRules.md index d7f59d89..dc4a15a2 100644 --- a/docs/topics/GeneratedRules.md +++ b/docs/topics/GeneratedRules.md @@ -92,6 +92,12 @@ a Rust dependency consumer can explicitly enable the feature. It is not an access-control or security seal. Echo product and adapter code must not use it as an application authoring escape hatch. +It is also excluded from Echo's public Rust alpha closure. No feature declared +by a published runtime package may activate native bootstrap directly or +transitively. The compatibility lane must remain in a `publish = false` package +and outside every packaged runtime feature combination. This boundary is owned +by [Public Rust release boundary](../architecture/public-rust-release-boundary.md). + ## Execution Corridors ### Provider-v1 compatibility corridor diff --git a/docs/topics/RuntimeAuthority.md b/docs/topics/RuntimeAuthority.md index 70907c44..2a31fe55 100644 --- a/docs/topics/RuntimeAuthority.md +++ b/docs/topics/RuntimeAuthority.md @@ -81,12 +81,36 @@ those remain required before an external host can prove the complete release lifecycle. The crate remains `publish = false`, so this boundary is executable release-engineering evidence rather than a published API promise. +The accepted alpha boundary keeps admission, epoch authority, Tick +construction, settlement, receipt construction, commit publication, and +recovery acceptance in private modules of the same package as the sealed +facade. A separate published implementation crate would require `pub` +inter-package APIs that every downstream caller could invoke. Opaque admitted +types must also refuse indirect construction through deserialization, defaults, +raw conversions, public variants, unchecked builders, or feature-gated test +seams. + +Verification and admission remain distinct. A verifier makes evidence about an +executable subject; the runtime correlates that evidence and decides whether to +admit and install the subject. Public API names must not claim that the runtime +performed verification unless it actually invoked the verifier. + +Every feature declared by a published runtime package must remain +authority-safe in every selectable combination. Release metadata may describe +tested configurations, but it is not an access-control boundary. The complete +accepted target and current implementation posture are defined by +[Public Rust release boundary](../architecture/public-rust-release-boundary.md) +and the +[public runtime authority invariant](../invariants/PUBLIC-RUNTIME-AUTHORITY.md). + ## Evidence Anchors - [Registry/provider/host boundary](../adr/0015-registry-provider-host-boundary.md) - [Durable external-action settlement](../adr/0026-durable-external-action-settlement.md) - [External actions](ExternalActions.md) - `docs/architecture/application-contract-hosting.md` +- `docs/architecture/public-rust-release-boundary.md` +- `docs/invariants/PUBLIC-RUNTIME-AUTHORITY.md` - `crates/warp-core/src/trusted_runtime_host.rs` - `crates/warp-core/src/engine_impl.rs` - `crates/echo-runtime/src/lib.rs` diff --git a/docs/topics/WAL.md b/docs/topics/WAL.md index 829624f0..4d36d367 100644 --- a/docs/topics/WAL.md +++ b/docs/topics/WAL.md @@ -15,6 +15,21 @@ The short rule is: Echo may only claim what its WAL can recover. ``` +The WAL mechanism retains and reports storage facts; it does not independently +admit them as causal truth. Public WAL types should therefore use passive names +such as candidate, encoded, stored, observed, or scanned. Authoritative, +admitted, committed, settled, and receipt-bearing concepts are runtime results +produced only after validation of realm, epoch, continuity, semantic records, +and release closure. + +For the first public alpha, Echo supports only retained WAL implementations +whose durability and fencing behavior is part of the release evidence. An +arbitrary in-process `WalBackend` can lie about `fsync`, crash atomicity, +ordering, or fencing in ways the runtime cannot independently observe. A public +third-party durable-backend trait is therefore deferred until a typed provider +guarantee and admission protocol exists. See +[Public Rust release boundary](../architecture/public-rust-release-boundary.md). + ## What We Found The current runtime WAL evidence says twelve concrete things.