feat(edict): execute authenticated source functions in pure and read operations

.github/workflows/ci.yml

@@ -151,7 +151,7 @@ jobs:
                   cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test --test executable_operation_pipeline_tests -- -D warnings -D missing_docs
 
             - name: cargo clippy (compiler-produced pure evaluation)
-              run: cargo clippy -p warp-core --features trusted_runtime --lib --test edict_pure_evaluation_tests --test edict_pure_unsigned_subtraction_tests --test edict_pure_byte_length_tests --test edict_byte_equality_tests --test edict_byte_slice_tests --test edict_node_read_tests --test edict_byte_concat_tests -- -D warnings -D missing_docs
+              run: cargo clippy -p warp-core --features trusted_runtime --lib --test edict_pure_evaluation_tests --test edict_pure_unsigned_subtraction_tests --test edict_pure_byte_length_tests --test edict_byte_equality_tests --test edict_byte_slice_tests --test edict_node_read_tests --test edict_byte_concat_tests --test edict_source_functions_tests -- -D warnings -D missing_docs
 
     clippy-det-fixed:
         name: Clippy (det_fixed)
@@ -322,7 +322,7 @@ jobs:
                   cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test --test executable_operation_pipeline_tests
             - name: cargo test (compiler-produced pure evaluation)
               run: |
-                  cargo test -p warp-core --features trusted_runtime --test edict_pure_evaluation_tests --test edict_pure_unsigned_subtraction_tests --test edict_pure_byte_length_tests --test edict_byte_equality_tests --test edict_byte_slice_tests --test edict_node_read_tests --test edict_byte_concat_tests
+                  cargo test -p warp-core --features trusted_runtime --test edict_pure_evaluation_tests --test edict_pure_unsigned_subtraction_tests --test edict_pure_byte_length_tests --test edict_byte_equality_tests --test edict_byte_slice_tests --test edict_node_read_tests --test edict_byte_concat_tests --test edict_source_functions_tests
                   cargo test -p warp-core --features trusted_runtime --lib edict_pure::
             - name: cargo test --doc (warp-core)
               run: cargo test -p warp-core --doc

CHANGELOG.md

@@ -15,6 +15,8 @@
 
 ### Fixed
 
+- Private Edict runtime decoding resolves named integer types through their declared width, matching source-function provider acceptance.
+
 - Filesystem writer takeover preserves unused LSNs after empty epochs and refuses unreconciled tails before changing the epoch ledger.
 
 - Incremental snapshot state roots now include the existing v1 domain separator and agree with canonical snapshot hashing. Previously emitted incorrect accumulator roots are not migrated.
@@ -111,6 +113,18 @@
 
 ### Added
 
+- Generic source-owned Edict functions execute through both private pure and
+  bounded-read evaluation with fresh lexical frames, ordered argument evaluation,
+  ordered local bindings, and one cumulative budget. Independent provider
+  judgments validate the complete source/imported closure, supported types,
+  totality, combined runtime depth, and conservative whole-operation costs.
+  Providers and runtime reject source functions that shadow authenticated
+  imported effects, including otherwise valid unused definitions. Bounded-read
+  call lookup distinguishes source and imported functions by exact membership,
+  including disjoint names under one package prefix.
+  Independent provider checks retain nominal type identity for source-function
+  compatibility while deriving runtime costs from the underlying representation.
+
 - Bounded pure evaluation supports generic `core.bytes.concat` with independent
   operand byte bounds, checked maximum composition, and combined-byte work and
   result storage charged before allocation/copy. Application names and text

crates/echo-edict-provider-lowerer/README.md

@@ -138,8 +138,8 @@ proposal constructor supports mutations and refuses a `Query`; authored reads
 remain a separate bounded observer/optic path and must never be represented as
 synthetic mutations.
 
-The refreshed 381,459-byte checked lowerer component has SHA-256
-`4b594a8165079f0a973741b9e27b468cf041f4ad53108fccae641dc35355bd2a` and has
+The refreshed 457,154-byte checked lowerer component has SHA-256
+`dc3edc7c4f194bd2fdd2b5a1ecc79f8fb7a24a5a31294a1f1fc30369c053b8d4` and has
 crossed the reproducible promotion boundary. The pinned Edict host admits its
 generated envelope under the owning `generated-artifact` CDDL root, and the
 isolated host fixture exercises the exact helper binding, typed codecs, EINT

crates/echo-edict-provider-lowerer/src/executable_operation.rs

@@ -3,6 +3,7 @@
 //! Generic data-only lowering into Echo's bounded executable-operation profile.
 
 mod bounded_read;
+mod source_functions;
 
 use std::collections::BTreeSet;
 
@@ -227,6 +228,7 @@ fn lower_compiler_produced_pure(
         intent,
     )?;
     validate_pure_target_ir(target_ir, request, closure.lawpack, intent_name, intent)?;
+    source_functions::validate(core, exports, false)?;
     validate_pure_result_projection(
         result_projection,
         closure.result_projection,

crates/echo-edict-provider-lowerer/src/executable_operation/bounded_read.rs

@@ -67,18 +67,19 @@ pub(super) fn lower(
     )?;
     let source = validate_bound(&closure.source.artifact, SOURCE_DOMAIN)?;
     let source = validate_source(&source, closure.source, &request.core)?;
-    require_exact_fields(
-        &core,
-        &[
-            "apiVersion",
-            "coordinate",
-            "imports",
-            "types",
-            "intents",
-            "requiredCoreCapabilities",
-        ],
-        SUBJECT,
-    )?;
+    let mut core_fields = vec![
+        "apiVersion",
+        "coordinate",
+        "imports",
+        "types",
+        "intents",
+        "requiredCoreCapabilities",
+    ];
+    if map_field(&core, "functions").is_some() {
+        core_fields.push("functions");
+    }
+    require_exact_fields(&core, &core_fields, SUBJECT)?;
+    super::source_functions::validate(&core, &exports, true)?;
     require_exact_fields(
         &configuration,
         &["apiVersion", "programKind", "maxReads", "maxReadBytes"],

crates/echo-edict-provider-lowerer/src/executable_operation/bounded_read/relation.rs

@@ -84,8 +84,17 @@ impl ReadRelation<'_> {
         }
         let body = field(intent, "body")?;
         require_exact_fields(body, &["locals", "nodes", "result"], SUBJECT)?;
-        let mut scope = Scope::new(self.core, array(body, "locals")?, text(intent, "input")?)?;
-        if scope.expression(field(intent, "basis")?, 0)? != ReadType::Bytes(32, 32) {
+        let mut scope = Scope::new(
+            self.core,
+            self.exports,
+            array(body, "locals")?,
+            text(intent, "input")?,
+        )?;
+        if scope
+            .expression(field(intent, "basis")?, 0)?
+            .representation()
+            != &ReadType::Bytes(32, 32)
+        {
             return Err(invalid());
         }
         for constraint in array(intent, "inputConstraints")? {