Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
52 commits
Select commit Hold shift + click to select a range
cb6993c
docs(changelog): merge duplicated Unreleased subsections
flyingrobots Oct 16, 2026
0973026
docs: propose Edict-authored rope law and an effect bridge
flyingrobots Oct 16, 2026
791e2b5
docs: harden the authored-effects design for review
flyingrobots Oct 16, 2026
81b549a
docs: witness absence and keep decided outcomes final
flyingrobots Oct 16, 2026
210eb39
docs: tie the effect bridge to Echo's identity, attribution, and WAL …
flyingrobots Oct 16, 2026
c05cf3e
docs(changelog): drop the unshipped authored-effects proposal entry
flyingrobots Oct 16, 2026
b26714f
docs: accept authored effects on merge and correct the bridge design
flyingrobots Oct 16, 2026
b1192d9
docs: mark remaining resource-route clauses and recover by outcome class
flyingrobots Oct 16, 2026
e8ae67d
docs: bind every proposal identity to its exact effects
flyingrobots Oct 16, 2026
9c13f3a
Merge remote-tracking branch 'origin/main' into docs/edict-authored-o…
flyingrobots Oct 16, 2026
bf5f2d6
docs: close the third review round on the authored-effects bridge
flyingrobots Oct 16, 2026
50e6a7e
docs: define target sets, scoped preconditions, and receipt digest v5
flyingrobots Oct 16, 2026
16fd7d1
docs: close the fourth review round on the authored-effects bridge
flyingrobots Oct 16, 2026
522e2ea
docs: name the evidence that detects a restored dependency
flyingrobots Oct 16, 2026
fa9ef3b
docs: close the fifth review round on the authored-effects bridge
flyingrobots Oct 16, 2026
168b91a
docs: close the sixth review round on the authored-effects bridge
flyingrobots Oct 16, 2026
4c809ff
docs: close the seventh review round on the authored-effects bridge
flyingrobots Oct 16, 2026
174fb8c
docs: close the eighth review round on the authored-effects bridge
flyingrobots Oct 16, 2026
64c3eb7
docs: close the ninth review round on the authored-effects bridge
flyingrobots Oct 16, 2026
93972b5
docs: close the tenth review round on the authored-effects bridge
flyingrobots Oct 16, 2026
fba27a2
docs: close the eleventh review round on the authored-effects bridge
flyingrobots Oct 16, 2026
7a241ea
docs: close the twelfth review round on the authored-effects bridge
flyingrobots Oct 16, 2026
9318d2c
docs: close the thirteenth review round on the authored-effects bridge
flyingrobots Oct 16, 2026
8facc13
docs: close the fourteenth review round on the authored-effects bridge
flyingrobots Oct 16, 2026
83999a8
docs: close the fifteenth review round on the authored-effects bridge
flyingrobots Oct 16, 2026
aac6b80
docs: close the sixteenth review round on the authored-effects bridge
flyingrobots Oct 16, 2026
002a114
docs: close the seventeenth review round on the authored-effects bridge
flyingrobots Oct 17, 2026
6f9d4b5
docs: specify bridge records as zero-copy images and an arena-only ho…
flyingrobots Oct 17, 2026
ef5989d
docs: close the nineteenth review round on the authored-effects bridge
flyingrobots Oct 17, 2026
1d11a1a
docs: close the twentieth review round on the authored-effects bridge
flyingrobots Oct 17, 2026
8fb04a6
docs: close the twenty-first review round on the authored-effects bridge
flyingrobots Oct 17, 2026
4a2c724
docs: close the twenty-second review round on the authored-effects br…
flyingrobots Oct 17, 2026
461af4a
docs: consolidate the authored-effects design after a whole-document …
flyingrobots Oct 17, 2026
b93603b
docs: resolve Ensure targets early; retain bridge results; canonical …
flyingrobots Oct 17, 2026
55a2008
docs: complete resolution, exact schema shapes, V2 domains; keyed-rea…
flyingrobots Oct 17, 2026
097936c
docs: topology writes keep whole-frontier validity; graph_schema key;…
flyingrobots Oct 17, 2026
debe4d8
docs: exact V2 package/closure/program/invocation maps; bridge patch …
flyingrobots Oct 17, 2026
21a4147
docs: candidate vs composite patches; EOACT004 decision coordinate; i…
flyingrobots Oct 17, 2026
f2885d3
docs: fix the effect package's profile identities and basis; bind Out…
flyingrobots Oct 17, 2026
9d50a31
docs: pin every inherited identity; evaluation read charges; typed reads
flyingrobots Oct 17, 2026
d02feb0
docs: orphan buckets, pinned profiles, id-keyed maps, typed read rows…
flyingrobots Oct 17, 2026
08cfaf3
docs: bridge Tick scope, mixed-batch digests, evaluation-only cost, p…
flyingrobots Oct 17, 2026
5ac35cd
docs: portal reads bind the owner type; inherited I/O ceilings; no re…
flyingrobots Oct 17, 2026
56896dd
docs: authorize every read before its value reaches the program
flyingrobots Oct 17, 2026
5ce3a98
docs: reads resolve their chain first; result capacity; content hash …
flyingrobots Oct 17, 2026
5d2850a
docs: footprint-law ceilings; ReplaceAtom never removes a portal; rea…
flyingrobots Oct 17, 2026
510546e
docs: effect budget ceilings, chains charged once, a per-effect permi…
flyingrobots Oct 17, 2026
58ff64c
docs: content mismatch before identity; resolve what the permission t…
flyingrobots Oct 17, 2026
537c153
docs: accept the architecture, authorize a bounded first profile, kee…
flyingrobots Oct 20, 2026
0df5810
Merge origin/main into docs/edict-authored-operation-effects
flyingrobots Oct 20, 2026
51b6df4
docs: describe #917's outgoing-edge range keys and their limits
flyingrobots Oct 20, 2026
be82442
docs: blockers are earlier-Action indices, not ranges
flyingrobots Oct 20, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1,218 changes: 603 additions & 615 deletions CHANGELOG.md

Large diffs are not rendered by default.

16 changes: 11 additions & 5 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -186,15 +186,21 @@ result, composition, and terminal outcome. Runtime-control installation and
scheduler Tick records permit callback-free fresh-host recovery. Program bytes
explicitly bind the interpreter and intrinsic profiles, while Tick evidence
binds each admitted installation. A program digest cannot confer operation
identity, invocability, or authority. Each package also retains the canonical
lawpack obstruction coordinate resolved from the authored source-local import;
the scheduler reports that exact typed coordinate without interpreting
application vocabulary.
identity, invocability, or authority. Each package whose program is imported
from a lawpack also retains the canonical lawpack obstruction coordinate
resolved from the authored source-local import; the scheduler reports that
exact typed coordinate without interpreting application vocabulary. A package
compiled from Edict source binds no lawpack: under the accepted
[Authored Operation Effects](docs/architecture/authored-operation-effects.md)
design, which is not yet implemented, its obstructions are qualified by the
admitted package and installed operation.

That generic runtime witness is not yet the Jim/Jedit vertical. A standalone
application-owned Edict operation now crosses it through a compiler-produced
package and structurally separate accepted verification report, but no Jedit
rope lawpack or `ReplaceRange` operation uses it. It does not yet claim
`ReplaceRange` operation uses it. Under the accepted Edict-source decision, the
rope law will be compiled from Jedit-owned Edict source rather than imported as
a lawpack. It does not yet claim
cross-category scheduler composition or independently implemented semantic
conformance. It also temporarily reuses `TrustedRuntimeHost`'s joint
`native_rule_bootstrap` and `trusted_runtime` feature gate. The program itself
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,12 @@ pinned Echo `schemas/edict-provider/package/v1` into `.build/echo-provider`.
Build the pinned Edict CLI, then send this request to it from the copied root:

```json
{"schema":"edict.compiler.settings/v1","type":"compilerSettings","operation":"build","application":"edict.application.json"}
{
"schema": "edict.compiler.settings/v1",
"type": "compilerSettings",
"operation": "build",
"application": "edict.application.json"
}
```

Compare `.build/application` package/report bytes with the decoded carriers.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
<!-- SPDX-License-Identifier: Apache-2.0 OR LicenseRef-MIND-UCAL-1.0 -->
<!-- © James Ross Ω FLYING•ROBOTS <https://github.com/flyingrobots> -->

# Public unsigned-addition control

The source and unmodified hex carriers come from Edict's public JSONL application
Expand Down
14 changes: 7 additions & 7 deletions crates/warp-core/tests/fixtures/legacy_causal_wal/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@ separated form must resolve to its original submission.
a reader accepts what an earlier writer actually wrote; bytes produced by the
current encoder cannot show that.

| File | Bytes | SHA-256 |
| --- | --- | --- |
| `segments/segment-00000000000000000001.ecwal` | 7594 | `95a762b44e674e7612ea74aff516034cdab192c8700c6c75d0a76b6386894457` |
| `writer-epochs.ecwal` | 231 | `bdef26980af969e059f52c3a212ade94cc26329083020b8bd1119313877efc61` |
| File | Bytes | SHA-256 |
| --------------------------------------------- | ----- | ------------------------------------------------------------------ |
| `segments/segment-00000000000000000001.ecwal` | 7594 | `95a762b44e674e7612ea74aff516034cdab192c8700c6c75d0a76b6386894457` |
| `writer-epochs.ecwal` | 231 | `bdef26980af969e059f52c3a212ade94cc26329083020b8bd1119313877efc61` |

## Provenance

Expand All @@ -28,13 +28,13 @@ guarded container, by a throwaway test added to
- the reference host (`runtime()`, `empty_engine()`) with a filesystem WAL and
the reference contract package;
- one WAL-acknowledged causal EINT intent, `causal_eint_envelope(lane,
[causal_receipt_ref(lane, "legacy-parent", 41)])`, staged with
[causal_receipt_ref(lane, "legacy-parent", 41)])`, staged with
`admission_ticket(61)` and decided by `run_until_idle(4)`: submission
`2348e63b4cd2b630e659d9bcac2e5456d56c35c7a5f04f717d07820a113888f7`, ingress
`811015cf74795d042fc637d41d506024f538206586707d533fede984a2dddcbf`;
- one WAL-acknowledged causal Continuum occurrence, `pack_intent_v1(MUTATION_OP_ID,
b"amount=9")` with the same parent and `ContinuumOccurrence::new([7; 32],
[0xa7; 32])`, left pending: submission
b"amount=9")` with the same parent and `ContinuumOccurrence::new([7; 32],
[0xa7; 32])`, left pending: submission
`8879b31036123e5b70962a068958f51e379750627e13abecf5b585d43fdd3f63`, ingress
`4af4cf66ff6f479386420b7d1df87e762ee5964323d402b3f378d007381acf8e`.

Expand Down
1 change: 1 addition & 0 deletions docs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ causal history. Git history is the archive; GitHub owns live work and status.

- [There Is No Graph](architecture/there-is-no-graph.md)
- [Sliced readings and copy-on-write strands](architecture/sliced-readings-and-copy-on-write-strands.md) (accepted design, not implemented)
- [Authored operation effects](architecture/authored-operation-effects.md) (architecture accepted on merge of #889, detailed specification provisional, not implemented)
- [Batched strict submission](architecture/batched-strict-submission.md)
- [Participant history as a braid](architecture/participant-history-as-a-braid.md) (accepted design, not implemented)
- [Continuum transport](architecture/continuum-transport.md)
Expand Down
115 changes: 115 additions & 0 deletions docs/adr/0023-admitted-executable-operation-packages.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,24 @@
- **Superseded in part by:** the [Action validity across ticks](../topics/GeneratedRules.md#action-validity-across-ticks)
decision of 2026-10-14 (#837), for every exact-basis requirement below as it
applies to Actions that meet that decision's conditions
- **Superseded in part by:** the
[Application operation semantics authored in Edict source](../topics/GeneratedRules.md#application-operation-semantics-authored-in-edict-source)
decision, accepted 2026-10-15 and effective when
[flyingrobots/echo#889](https://github.com/flyingrobots/echo/pull/889) merges
to `main`, for the declarative-resource and lawpack requirements that
Comment thread
flyingrobots marked this conversation as resolved.
assume the rope law is an imported resource, in this ADR's rope-law
closure, package binding, package obligations, evidence grades,
Jurisdiction, and Consequences (enumerated in the "Jedit rope-law closure"
banner), and the selection under "Alternatives for Expressing the Rope Law"
- **Superseded in part by:**
[Authored Operation Effects](../architecture/authored-operation-effects.md),
effective when [flyingrobots/echo#889](https://github.com/flyingrobots/echo/pull/889)
merges to `main`, for bridge Actions only: the prepared-evaluation outcome
(a successful evaluation exposes one patch; the closed
`PreparedEchoOperationOutcomeV1`; no patch digest on `Obstructed`), marked
where it appears. The merge accepts this as architecture; the detailed
bridge contract stays provisional until executable evidence, per
[What merging accepts](../architecture/authored-operation-effects.md#what-merging-accepts)

> **Scheduler lifecycle amendment:** This ADR established exact package,
> invocation, private-evaluation, and recovery semantics. ADR 0025 supersedes
Expand Down Expand Up @@ -101,6 +119,13 @@ Edict intent / admitted executable-operation package
→ binds the exact EchoOperationProgramV1 bytes and digest
```

> **Superseded in part,** effective when flyingrobots/echo#889 merges: the
> lawpack step applies only to a program whose executable meaning is imported
> from a lawpack resource. A program compiled from Edict source, such as
> Jedit's `ReplaceRange`, goes from the canonical semantic closure directly to
> the exact program bytes and digest, and binds no lawpack resource. See the
> [Jedit rope-law closure](#jedit-rope-law-closure) banner.

The admitted Edict operation supplies the public operation coordinate,
invocation and result schemas, basis contract, budget and footprint contract,
authority requirements, result and obstruction interpretation, and the
Expand Down Expand Up @@ -136,6 +161,13 @@ Every `ExecutableOperationPackageV1` must canonically bind:
- result and obstruction interpretation;
- one evaluator ABI and intrinsic-profile identity.

> **Superseded in part,** effective when flyingrobots/echo#889 merges: the
> lawpack resource coordinate and digest are bound only by a package whose
> program is imported from a lawpack resource. A package whose program is
> compiled from Edict source binds no lawpack resource; every other
> obligation above still applies to it. See the
> [Jedit rope-law closure](#jedit-rope-law-closure) banner.

Every bound `EchoOperationProgramV1` must canonically bind its executable
meaning:

Expand All @@ -159,6 +191,22 @@ exposes one normal Echo patch; an obstructed evaluation exposes no parent
mutation. Version 1 retains an execution or trace identity sufficient to bind
later evidence without claiming that a durable child worldline already exists.

> **Superseded in part,** effective when flyingrobots/echo#889 merges: for
> bridge Actions, whose compiled Edict program proposes effects, the
> evaluation and outcome contract here is replaced by
> [Authored Operation Effects](../architecture/authored-operation-effects.md).
> A bridge evaluation yields an `EffectProposal` or a typed obstruction rather
> than a patch, Echo derives the patch afterwards in the same Tick
> construction, and the receipt posture defined there replaces
> `PreparedEchoOperationOutcomeV1`; some obstructed postures record a derived
> patch digest that was never committed. Atomic visibility, one parent patch
> or one obstruction, still governs. The original text is preserved and still
> governs every other Action. The merge accepts this replacement as
> architecture. The posture, record, and digest details stay provisional
> until executable evidence fixes them, as
> [What merging accepts](../architecture/authored-operation-effects.md#what-merging-accepts)
> states, and no bridge Action exists until the first bridge profile ships.

The program may use generic primitives for typed graph access, canonical scalar
operations, checked `u64` arithmetic, bounded byte manipulation, UTF-8
validation, canonical hashing, content-address derivation, and graph-delta
Expand Down Expand Up @@ -220,6 +268,22 @@ An `Obstructed` outcome never enters parent commit or scheduler composition and
never carries a patch digest. It may produce retained typed execution evidence,
but it does not claim a committed consequence.

> **Superseded in part,** effective when flyingrobots/echo#889 merges: for
> bridge Actions, whose compiled Edict program proposes effects, the
> evaluation and outcome contract here is replaced by
> [Authored Operation Effects](../architecture/authored-operation-effects.md).
> A bridge evaluation yields an `EffectProposal` or a typed obstruction rather
> than a patch, Echo derives the patch afterwards in the same Tick
> construction, and the receipt posture defined there replaces
> `PreparedEchoOperationOutcomeV1`; some obstructed postures record a derived
> patch digest that was never committed. Atomic visibility, one parent patch
> or one obstruction, still governs. The original text is preserved and still
> governs every other Action. The merge accepts this replacement as
> architecture. The posture, record, and digest details stay provisional
> until executable evidence fixes them, as
> [What merging accepts](../architecture/authored-operation-effects.md#what-merging-accepts)
> states, and no bridge Action exists until the first bridge profile ships.
>
> **Superseded in part (2026-10-14, #837):** for Actions that meet the
> conditions of [Action validity across ticks](../topics/GeneratedRules.md#action-validity-across-ticks),
> the exact-basis requirement here is replaced by dependency-scoped validity.
Expand Down Expand Up @@ -291,6 +355,32 @@ admission posture without adding broad authorization policy to this decision.

### Jedit rope-law closure

> **Superseded in part,** effective when
> [flyingrobots/echo#889](https://github.com/flyingrobots/echo/pull/889) merges
> to `main`. The rope law is authored in Jedit-owned Edict source rather than
> imported as a declarative executable resource. See
> [Application operation semantics authored in Edict source](../topics/GeneratedRules.md#application-operation-semantics-authored-in-edict-source).
> The text below is kept as written, for its reasoning.
>
> **No longer required:** the declarative resource and lawpack named in the
> first paragraph; the fifth required binding (the rope-law resource
> coordinate and digest); the lawpack and `EchoOperationProgramV1` steps of the
> binding chain and the paragraph after it; the paragraphs on what makes
> the resource acceptable and who owns it; and, outside this section, the
> lawpack step of the package binding direction and the lawpack obligation in
> "First-version execution obligations" (both now apply only to a program
> imported from a lawpack resource), the
> lawpack-resource binding in the evidence-grade table, the rope-law resource
> and generic resource binding in Jurisdiction, and the executable-resource
> binding in Consequences, each marked where it appears.
>
> **Still governing:** the versioned canonical text-schema declaration and its
> first four required bindings; the package's binding of that declaration's
> coordinate and digest, with the typed schema-closure refusal, applied to the
> package's compiled Edict program in place of the lawpack and subordinate
> program; the prohibited forms, which the compiled Edict program may not
> contain or resolve to; and the handwritten planner's test-only role.

For the first `ReplaceRange` vertical, Jedit will use a digest-locked canonical
declarative executable semantic resource imported through a Jedit-owned Edict
lawpack. This decision does not require Edict source to express the complete
Expand Down Expand Up @@ -375,6 +465,10 @@ smaller. Implementing the entire language surface before any hook-free
operation runs would turn the first witness into a broad language and runtime design
effort and would make `ReplaceRange` define unproven universal syntax.

> **Superseded in part,** effective when flyingrobots/echo#889 merges: the
> superseding decision linked in this record's header selects this route,
> Edict source, for the rope law. The rejection above is kept as written.

### Bind a canonical declarative executable resource from a Jedit lawpack

This route adds only the Edict prerequisites needed to type the real operation,
Expand All @@ -388,6 +482,11 @@ proof chain without broad Edict expansion. It does not establish a permanent
rule that complex Edict operations must be authored as external resources.
Later Edict syntax may compile to the same target program boundary.

> **Superseded in part,** effective when flyingrobots/echo#889 merges: this
> selection was never implemented and is superseded by
> [Application operation semantics authored in Edict source](../topics/GeneratedRules.md#application-operation-semantics-authored-in-edict-source).
> The selection and its rationale above are kept as written.

## Verification Evidence Grades

The word "independent" is reserved for an implementation that does not merely
Expand All @@ -409,6 +508,12 @@ the following grades.
| Repeated evaluation by the same Echo evaluator | Deterministic self-validation | The implementation is repeatable for the tested basis and inputs; it is not an independent implementation. |
| Receipt/WAL round-trip and fresh-host reconstruction | Deterministic self-validation | Retained bytes reconstruct the same installed and execution identities without callbacks. |

> **Superseded in part,** effective when flyingrobots/echo#889 merges: the
> "lawpack resource" in the target-verifier row above. The row's check now
> covers the admitted package and Target IR to the program compiled from
> Jedit's Edict source, with the same evidence grade. See the
> [Jedit rope-law closure](#jedit-rope-law-closure) banner.

A separate verifier crate is not, by itself, independently implemented
conformance evidence. This decision does not claim formal refinement, complete
semantic equivalence, a clean-room Echo interpreter, or a proof that all
Expand All @@ -422,6 +527,11 @@ by comparing two wrappers around the same algorithm.

## Jurisdiction

> **Superseded in part,** effective when flyingrobots/echo#889 merges: Jedit
> owns the `ReplaceRange` law as Edict source rather than a rope-law resource,
> and Edict's generic resource binding is no longer part of this operation's
> route. See the [Jedit rope-law closure](#jedit-rope-law-closure) banner.

- **Jedit** owns `ReplaceRange.edict`, the rope-law resource, fact schemas,
codec/identity law, operation semantics, and the differential oracle corpus.
- **Edict** owns source parsing, typing, canonical meaning, Core, generic
Expand Down Expand Up @@ -485,6 +595,11 @@ by comparing two wrappers around the same algorithm.
- The existing Jedit planner becomes migration evidence rather than production
execution authority.

> **Superseded in part,** effective when flyingrobots/echo#889 merges: the
> rope law no longer needs executable-resource binding, and Edict gains
> language features only when the authored source demonstrates the need. See
> the [Jedit rope-law closure](#jedit-rope-law-closure) banner.

## Non-Goals

- Cyber Kitten syntax or runtime;
Expand Down
20 changes: 20 additions & 0 deletions docs/adr/0025-scheduler-owned-executable-operation-actions.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,14 @@
- **Superseded in part by:** the [Action validity across ticks](../topics/GeneratedRules.md#action-validity-across-ticks)
decision of 2026-10-14 (#837), for the shared parent basis of Actions in one
Tick
- **Superseded in part by:**
[Authored Operation Effects](../architecture/authored-operation-effects.md),
effective when [flyingrobots/echo#889](https://github.com/flyingrobots/echo/pull/889)
merges to `main`, for bridge Actions only: the prepared candidate returned
on success and the lawpack qualification of an evaluation obstruction,
marked where it appears. The merge accepts this as architecture; the detailed
bridge contract stays provisional until executable evidence, per
[What merging accepts](../architecture/authored-operation-effects.md#what-merging-accepts)

## Context

Expand Down Expand Up @@ -74,6 +82,18 @@ worldline:
and no parent-visible operations;
- neither result mutates the parent state.

> **Superseded in part,** effective when flyingrobots/echo#889 merges: for
> bridge Actions, whose program is compiled from Edict source and binds no
> lawpack resource, an obstruction is qualified by the admitted package and
> installed-operation identities instead of a lawpack, and success returns an
> `EffectProposal` rather than a prepared candidate, as
> [Authored Operation Effects](../architecture/authored-operation-effects.md)
> defines. The original text is preserved and still governs every other
> Action. The merge accepts this replacement as architecture. The detailed
> bridge contract stays provisional until executable evidence fixes it, as
> [What merging accepts](../architecture/authored-operation-effects.md#what-merging-accepts)
> states, and no bridge Action exists until the first bridge profile ships.

The direct `prepare_echo_operation_v1` and
`commit_prepared_echo_operation_v1` methods remain publicly reachable on
`TrustedRuntimeHost` as explicitly transitional, documentation-hidden
Expand Down
Loading
Loading