Self-host Obligation Authority v0.1

Status: normative partial H2 migration contract for SD-OBLIGATION. This version does not promote the ledger row or close R4.2.d.

core/cli::obligation-authority is the sole production semantic producer for the core/obligation::unit-tests, core/obligation::budgets, core/obligation::capabilities-declared, core/obligation::determinism, core/obligation::lint, core/obligation::ai-style, core/obligation::replayable-tests, core/obligation::concurrency-replay, core/obligation::property-tests, core/obligation::stage1-validation, core/obligation::coverage, core/obligation::coverage-decision, core/obligation::coverage-mcdc, core/obligation::gfx-api-stability, core/obligation::gfx-golden-images, core/obligation::gfx-frame-budgets, core/obligation::typecheck, and core/obligation::typecheck-strict decisions. The host executes test bodies, enforces previously authorized effects, records canonical value hashes and sealed-error status, measures steps and effect-log sizes, transports canonical module forms and ordered effect-operation observations, and persists opaque effect logs. It does not decide whether an expectation matches, a budget is exceeded, a suite belongs to a module, an observed operation was declared, a pure declaration is contradicted by inferred or runtime effects, a replay value matches, a task-log entry satisfies scheduling metadata rules, or a package typechecks.

Closed Protocol

The request kind is genesis/obligation-authority-request-v0.2, has :v 2, and contains exactly :kind, :v, :operation, :package, and :inputs. Each operation has a distinct closed input map so later migrations cannot overload a field whose name encodes another operation’s semantics.

For :unit-tests, :inputs contains exactly :tests; every ordered observation contains exactly :suite, :name, :actual-h, :expected-h, :sealed-error, and :log-artifact. Hashes are 32 bytes; expected hash and log artifact are explicitly nullable. A test passes only when it is not a sealed error and either has no expectation or its exact canonical value hash equals the expected hash.

For :budgets, :inputs contains exactly :limits and :tests. :limits contains exactly the three nullable nonnegative integer fields :max-steps-per-test, :max-effect-entries-per-test, and :max-effect-log-bytes-per-test. Every observation contains exactly :suite, :name, :steps, :effect-entries, and :effect-log-bytes. A configured limit is inclusive; only an observed value strictly greater than it fails.

For :capabilities-declared, :inputs contains exactly ordered :modules and :tests. Each module contains exactly its base-relative manifest :path and canonical :forms. Each test with an effect log contains exactly :suite, :name, and the canonically ordered unique :used-ops observed in that log. GenesisCode validates the complete module inventory even when no test has an effect log, then resolves the first ordered module defining the suite, extracts its canonical ::meta, requires symbol-vector :caps, and emits one canonical error for every observed operation absent from that declaration. Missing suite ownership is a failed obligation; malformed module/meta/capability facts are sealed protocol errors. Tests without effect logs produce no operation observations, preserving the v0.2 obligation semantics.

For :typecheck and :typecheck-strict, :inputs contains exactly ordered :modules, each with only its base-relative :path and canonical :forms. GenesisCode validates the complete closed inventory, derives each module’s ::meta from those forms, constructs the closed genesis/typecheck-request-v0.1, and invokes the already H2 core/cli::typecheck-package authority. The host cannot supply or substitute metadata. For :typecheck-strict, GenesisCode replaces a missing or non-map ::meta with an empty map and sets both :strict-effects and :strict-shapes to true before invoking the checker. Rust independently reconstructs this closed input only while decoding the returned report; it does not produce the obligation decision or provide metadata to GenesisCode.

For :lint, :inputs contains exactly ordered :modules in the same closed base-relative shape. GenesisCode invokes the Prelude core/editor/lint::lint-module authority for every module, preserves diagnostic order and bytes, and fails only diagnostics whose normalized level is :error. When a canonical ::meta has a symbol-vector :exports and either lacks a map :types or omits an exported symbol, GenesisCode produces exactly one version-1 lint/autofix-types semantic patch. The patch preserves every unrelated metadata field, inserts ? only for missing exported-symbol types, and replaces the exact metadata form by base-relative module path and form index. Warnings remain non-failing in the lint obligation even when they have an autofix.

For :ai-style, :inputs contains exactly the same ordered :modules and GenesisCode derives the lint report directly rather than accepting a host-authored lint artifact. It normalizes diagnostic levels to :error, :warn, or :info; all errors fail, and warnings fail only for the closed strict-code set missing-meta, malformed-meta, missing-exports, export-not-symbol, missing-types-map, missing-type, missing-intent, intent-not-string, missing-caps, and caps-not-vector in the editor/lint/ namespace. Ordered diagnostic IDs bind module path, diagnostic index, and code. Canonical fix records and patch intents may reference only the lint autofix produced for the same module.

For :determinism, :inputs contains exactly the same ordered :modules and :tests observation shapes as :capabilities-declared. GenesisCode derives each module’s metadata, invokes the H2 package typechecker, and applies the two existing v0.2 rules in order. First, a module with a valid :caps vector that filters to the empty symbol set fails when its aligned typecheck report has unknown or nonempty inferred operations. Second, each observed test with at least one unique effect operation fails when its first defining module has that empty capability set. Missing or malformed metadata/capability fields and tests whose suite has no defining module preserve the legacy no-decision behavior rather than inventing a new failure. Ordered static errors precede ordered runtime errors. Open module or test observations are sealed protocol errors.

For :replayable-tests and :concurrency-replay, :inputs contains exactly ordered :tests for tests that emitted effect logs. Each observation contains exactly :suite, :name, :log-artifact, :program, :actual-h, :replay-h, and :entries. The host re-evaluates the named test body under the declared kernel limits, reports whether its raw runtime kind is an effect program, and, only for an effect program, executes strict effect-log replay and reports the resulting canonical value hash. A non-program observation has a nil replay hash; a program observation has a 32-byte replay hash. Each ordered entry contains exactly its zero-based :position, raw :op, and nullable :task-id, :schedule-step, and :await-edge. The log artifact is persisted as raw provenance, but no host field asserts replayability, concurrency eligibility, scheduling validity, or obligation success.

GenesisCode makes the replay decisions. :replayable-tests requires every observed test to produce an effect program and its replay hash to equal the original value hash. :concurrency-replay selects observations containing at least one core/task:: or editor/task:: operation, counts those tests, applies scheduling rules only to task-like entries, and then applies the same program/hash rule. Every task-like entry requires :schedule-step equal to its zero-based position; core/task::await requires an await edge; and await, cancel, status, editor poll, and editor cancel require a task identity. Error order is test order, then entry order, then schedule, await-edge, task-id, and replay result. Tests without effect logs are absent, preserving the existing obligation behavior. Replay execution or log decoding failure remains an explicit host-boundary error rather than a synthetic policy result.

For :property-tests, authority is two-phase and both requests are bound in full. The :plan phase contains exactly :configured, :default-cases, :phase, and ordered :suites. Suite and entry observations carry only manifest position, raw shape, printable invalid values, callable presence, and the raw optional case integer. GenesisCode validates those facts, preserves legacy error order, derives every case count, constructs each seed with the normative GCv0.2\0property\0seed\0 BLAKE3 domain and little-endian case index, and emits the exact ordered test plan with :stop-rule :first-non-pass. The host strictly checks request binding and plan contradictions, then invokes only the referenced callables with the authorized seeds. It records ordered raw value, apply-error, or effect-program outcomes and stops only when the plan’s declared rule requires it. The :finalize phase contains the same immutable inputs plus exactly those raw outcomes. GenesisCode rejects omitted, additional, reordered, seed-substituted, or post-failure attempts and produces the canonical genesis/property-tests-v0.2 report and errors. Rust independently reconstructs the report only to reject a contradiction before persistence; it does not supply the production verdict.

For :stage1-validation, :inputs contains exactly ordered :modules. Each module observation contains exactly its base-relative :path, original and transformed canonical module hashes, original and transformed pure-evaluation outcomes, and four nonnegative optimizer counters. An evaluation outcome is closed: success has a 32-byte value hash and nil error, while failure has nil value hash and a raw string error. Rust performs the conservative transform, canonicalization, and caller-bounded isolated Prelude evaluation as mechanisms; it does not transport a gate verdict or error list. GenesisCode validates every closed observation, derives original/transformed evaluation failures and pure-value hash mismatches in normative order, prefixes aggregate errors by module path, and emits the exact genesis/stage1-validation-v0.2 report. The host independently reconstructs that report only to reject request substitution, malformed outcomes, or contradictory output before persistence.

For :coverage, :coverage-decision, and :coverage-mcdc, :inputs contains exactly :profile, :test-count, ordered tracked :exports, ordered expected :statement-sites, ordered expected :decision-sites, aggregate :decision counts, ordered per-test instrumentation in :tests, and ordered test names in :missing-effect-logs. Export and statement observations contain only identity and nonnegative hit count. A decision observation contains only its site identity, ordered expected condition identities, nonnegative total/true/false counts, and ordered raw samples; each sample contains its raw outcome and ordered condition/value pairs. The host discovers static sites, executes and replays tests under caller limits, and aggregates instrumentation with saturating counters. It does not transport missing-site, branch-complete, MC/DC-independent, error, pass/fail, or report facts.

GenesisCode validates the closed observations and owns all three profiles. Symbol coverage rejects uncovered non-test exports. Decision coverage additionally requires every expected statement site to be hit and every expected decision site to have nonzero total, true, and false counts. MC/DC additionally requires, for each expected condition, two complete samples where only that condition changes and the decision outcome changes. GenesisCode preserves export, statement, decision-site, condition, and sample order; derives the legacy ordered errors; and emits the exact genesis/coverage-v0.2 report. The host independently reconstructs the same decision only to reject malformed, substituted, or contradictory output, then persists the validated GenesisCode report.

For :translation-validation, :inputs contains exactly ordered :modules, :original-tests, and :optimized-tests. Each module carries its base-relative path, original and optimized canonical hashes, raw optimizer counters and rewrite counts, and one closed stage-2 mechanism observation. The stage-2 observation contains its raw completion class (:complete, :failed, or :unsupported), optimized module hash, optional WASM/hash/value-kind/byte-count outputs, optional kernel and WASM value hashes, raw result-equality fact, and mechanism errors. A complete observation requires every output, a boolean equality fact, and no mechanism error; incomplete observations require nil equality. Its module hash must equal the enclosing optimized hash. Original-test rows contain only identity, sealed-error state, and actual/optional expected hashes. Optimized-test rows align one-for-one by identity and bind their original hash to the corresponding original-test actual hash. A no-test request contains no module or optimized-test facts, preserving the legacy short-circuit exactly.

Rust performs conservative optimization, canonicalization, optional self-host/Rust transform parity, stage-2 compile and execution, and optimized-package test reruns under caller limits. It converts a completed stage-2 mechanism result into the primitive equality fact and does not transport the prior report verdict or mismatch messages. GenesisCode validates the complete inventory, derives original-test acceptance, stage-2 support/validation counts and exact mismatch errors, optimizer aggregates, module-change rows, optimized-test hash mismatches, overall disposition, and the canonical genesis/translation-validation-v0.2 report. The host independently reconstructs that report only to reject malformed, substituted, or contradictory output, then persists the validated GenesisCode report.

For :gfx-api-stability, :inputs contains exactly ordered :definitions, canonical unique :exports, canonical unique :expected-exports, and nullable :expected-surface-h. Each definition row contains exactly its raw symbol and the 32-byte canonical expression hash of that def; duplicate rows remain ordered so GenesisCode can detect the first conflicting cross-module definition. The host extracts definitions and module metadata, computes expression hashes, canonicalizes the two manifest/export sets, and lowercases the configured hash. These are mechanism facts, not gfx membership, surface, configuration-validity, or acceptance decisions.

GenesisCode validates the closed inventory, selects only core/gfx/ exports, chooses the configured set or discovered set as the tracked API, builds the exact genesis/gfx-api-surface-v0.2 term from tracked symbols and definition hashes, computes its canonical hash, and owns all configuration, missing/extra export, empty surface, surface-hash mismatch, and missing-definition diagnostics in legacy order. It emits the exact genesis/gfx-api-stability-v0.2 report. Rust independently reconstructs that report only to reject malformed, substituted, or contradictory output before persistence; it cannot provide a surface, verdict, diagnostic, or report to the production authority.

For :gfx-golden-images and :gfx-frame-budgets, authority is two-phase. The :plan request contains exactly :configured, :phase, and ordered :suites; frame-budget requests additionally contain the exact four manifest limits. Suite and entry observations bind manifest order, raw shape, key identity and display, callable-body presence, and, for golden entries, raw expected term hash, optional PNG hash, kind, and pixel dimensions. GenesisCode validates every closed field, normalizes 32-byte hashes and bounded dimensions, preserves legacy error precedence, and emits an immutable ordered genesis/gfx-golden-plan-v0.1 or genesis/gfx-frame-budget-plan-v0.1. A plan is not acceptance evidence.

Rust independently reconstructs the plan to reject a contradiction, invokes only the exact callable bodies selected by that plan under caller limits, and records raw value, apply-error, effect-program, or sealed-error outcomes. It performs headless rendering only when an authorized frame-graph golden case has an expected PNG hash. That renderer observation is bound to the canonical frame hash and exact authorized pixel dimensions and contains only a raw renderer error or PNG hash. The :finalize request repeats the immutable suite facts and limits and adds the complete ordered outcomes. GenesisCode rejects omitted, added, reordered, or substituted outcomes; extracts scene/frame payloads; computes canonical term hashes, frame time, render-pass and draw-command counts, and canonical frame bytes; applies all golden and budget policy; and emits the exact final reports and ordered errors. Rust reconstructs the final report only as a contradiction oracle and persists only the validated GenesisCode report.

The result kind is genesis/obligation-authority-result-v0.2, has :v 2, and contains exactly :errors, :kind, :name, :ok, :operation, :report, :request-h, and :v. :request-h is the 64-character lowercase genesis/hash-profile/gcv0.2-blake3 identity of the complete closed request. GenesisCode computes it through selfhost/hash::hash-term; the host independently applies the same normative hash profile to the exact request it invoked and rejects a result bound to any other request without recomputing the GenesisCode policy decision. The embedded report preserves the existing genesis/unit-tests-v0.2, genesis/budgets-v0.2, genesis/caps-declared-v0.2, genesis/determinism-v0.2, genesis/lints-v0.2, genesis/ai-style-v0.1, or genesis/typecheck-v0.2 artifact shape and ordering. Replay reports preserve genesis/replayable-tests-v0.2 and genesis/concurrency-replay-v0.1; both contain ordered errors and the latter binds the exact concurrent-test count. Property reports preserve genesis/property-tests-v0.2; the intermediate closed plan is genesis/property-test-plan-v0.1 and is never acceptance evidence by itself. Stage1 reports preserve genesis/stage1-validation-v0.2, including ordered per-module optimizer observations and aggregate path-prefixed errors. Coverage reports preserve genesis/coverage-v0.2, including the exact profile, per-test instrumentation, aggregate structural counts, ordered site decisions, MC/DC status, missing inventories, and errors. Translation reports preserve genesis/translation-validation-v0.2, including the legacy no-test shape, optimizer aggregates, module changes, stage-2 entries and counts, optimized-test hashes, and ordered errors. Gfx API reports preserve genesis/gfx-api-stability-v0.2, including the exact canonical surface term and hash, optional expected hash, ordered errors, and final disposition. Gfx runtime reports preserve genesis/gfx-golden-images-v0.2 and genesis/gfx-frame-budgets-v0.2; their intermediate plan reports are genesis/gfx-golden-plan-v0.1 and genesis/gfx-frame-budget-plan-v0.1 and cannot serve as acceptance evidence.

For :preflight, :inputs contains exactly nullable :module-load-error, ordered :modules, nullable :dependency-error, and nullable :caps-error. Each successfully loaded module contains exactly its base-relative :path, raw optional pinned hash, and 32-byte computed canonical module hash. Rust performs only bounded module loading/canonical hashing, dependency artifact hashing, and capability-policy loading and hashing. Mechanism errors are normalized against the package and policy roots before transport; no absolute host path is admitted to the request or persisted artifact.

GenesisCode validates the closed inventory and owns fail-fast precedence: module-load failure; otherwise every missing or mismatched module pin in manifest order; otherwise dependency failure; otherwise capability-policy failure. It constructs the stable missing-pin repair command using package.toml, derives the exact ordered errors and disposition, and emits genesis/preflight-v0.2. The authority executes under the profile’s fixed five-million-step and ten-million allocation-unit control-plane budget rather than the package’s possibly invalid limits. A successful preflight returns the observed modules, policy, and policy hash to later mechanisms without persisting a synthetic passing obligation. On failure the validated report is persisted as the sole acceptance obligation. Rust independently reconstructs only the expected precedence and report to reject malformed, substituted, or contradictory authority output. The host decoder rejects open, missing, reordered, renamed, contradictory, or observation-substituting output before persistence. Malformed or open requests, unknown operations, invalid facts, negative counters, and resource exhaustion return a sealed protocol error and never synthesize a pass.

The :lint and :ai-style result :report is a closed transport map containing exactly :artifact-terms and :final. Each side-artifact row contains exactly a lowercase 64-character :hash and canonical :term; the hash is the EvidenceStore BLAKE3 identity of the canonical print-term UTF-8 bytes. Lint transports only autofix patches. AI-style transports those patches plus its complete derived lint report, whose hash is the final report’s :lint-artifact. Rust independently recomputes every side hash, reconstructs the exact metadata-preserving lint patch from the input module, derives every AI-style diagnostic/fix/failure, rejects any extra, missing, duplicate, or contradictory artifact, and persists nothing until the complete final report validates. It then requires EvidenceStore persistence to return the same hash.

Authority Boundary

Production package testing passes the exact selected self-host artifact and resource limits into this authority. Rust retains only execution, measurement, artifact-store transport, strict decoding, and contradiction rejection. The former Rust unit-test, budget, suite-ownership, capability-membership, determinism-policy, ordinary typecheck-obligation, and strict typecheck-obligation decision implementations are absent from production source. The former Rust lint traversal, autofix producer, strict-warning classifier, AI-style diagnostic producer, and artifact-loading composition path are also absent. The former Rust task-operation classifier, scheduling-policy checks, replay-hash comparison, concurrent-test counter, and replay report producer are absent; one bounded host observation pass is shared by both replay obligations. The former reachable Rust property inventory, seed-plan, failure-decision, and report path is replaced by the two-phase authority; the host retains callable invocation and an independently checked implementation of the authorized first-non-pass stop mechanism. Neither an environment variable nor a feature can silently restore them.

The former reachable Rust stage1 gate-report path is absent from production obligation execution. Rust retains optimizer transformation, canonical hashing, caller-bounded pure module evaluation, raw evaluation-error transport, optimizer counters, and a strict contradiction decoder; GenesisCode alone derives stage1 equivalence policy, errors, pass/fail, and the persisted report.

The former reachable Rust coverage report-persistence path is absent from production obligation execution. Rust retains static instrumentation discovery, caller-bounded test evaluation, strict effect-log replay, raw counter/sample collection, deterministic aggregation, and an independently checked contradiction implementation. GenesisCode alone applies symbol, statement, decision, and MC/DC policy and produces the persisted report.

The former reachable Rust translation-validation decision/report path is absent from production obligation execution. Rust retains bounded optimizer and stage-2 mechanisms, transform parity enforcement, optimized-package test execution, raw observation construction, and an independently checked contradiction implementation. GenesisCode alone derives translation support, equivalence, errors, pass/fail, aggregates, and the persisted report.

The former reachable Rust gfx API surface-selection, configuration-policy, diagnostic, report-production, and persistence path is absent from production obligation execution. Rust retains ordered definition and metadata extraction, canonical expression hashing, manifest fact normalization, and an independently checked contradiction implementation. GenesisCode alone derives tracked gfx membership, surface content and identity, all errors, pass/fail, and the persisted report.

The former reachable Rust golden-case parsing, test selection, hash comparison, frame-budget calculation, diagnostic, report-production, and persistence path is absent from production obligation execution. Rust retains closed suite observation, caller-bounded callable invocation, conditionally authorized headless rendering, and independently checked plan/final contradiction implementations. GenesisCode alone selects valid cases, validates configuration, extracts results, computes metrics, applies all golden and frame-budget decisions, orders errors, and produces the persisted reports.

The former reachable Rust preflight error ordering, module-pin decision, diagnostic construction, report construction, and failure disposition are absent from production package testing. Rust retains bounded package-loading mechanisms, base-relative error normalization, and an independent contradiction decoder. A missing or unreadable capability policy is captured as deterministic preflight acceptance evidence rather than escaping through an unsealed host error.

policies/selfhost_obligation_authority_v0.1.json binds the exact ordered source set, artifact, entrypoint, migrated and residual obligation inventories, primitive host facts, and nonclaims. sourceSetSha256 is SHA-256 over the domain genesis/selfhost-obligation-authority-source-set-v0.1\0, followed for each declared module by its UTF-8 path length as an unsigned 64-bit big-endian integer, path bytes, source byte length in the same encoding, and exact source bytes. scripts/lib/selfhost_obligation_authority.py independently validates that profile, the production call sites and dependency graphs, removal of the previous host decision paths, and mutation controls. Focused Rust tests and native/WASI CLI runtime observations cover matching, mismatch, sealed error, inclusive/exceeded limits, declared/undeclared operations, missing suite ownership, open requests, unknown operations, host metadata and strictness injection, static/runtime determinism failures, lint errors and warnings, canonical autofix persistence, strict AI-style warnings, side-artifact substitution, contradictory final reports, valid/failing ordinary and strict package routes, replay hash disagreement, open replay observations, missing task scheduling fields, contradictory concurrent counts, exact property seeds, full passing case execution, first-case failure, and seed-plan tampering. Stage1 controls cover pure equivalence, raw evaluation failure, pure-value mismatch, open observation rejection, exact request binding, and report tampering. Coverage controls exercise all three profiles, missing branches, missing MC/DC independence, open observations, exact request binding, report tampering, and a real uncovered-export package. Translation controls cover complete, divergent, and no-test observations, stage-2 and optimized-test mismatches, open and misaligned facts, exact request binding, report tampering, and the authentic optimized pkg_basic package. Gfx API controls cover a valid configured surface, missing exports, conflicting definitions, open observations, request substitution, and surface-report tampering; native/WASI fixtures exercise both a complete graphics package and a configured surface-hash mismatch. Gfx runtime controls cover passing term and PNG goldens, term-hash and PNG-hash mismatches, frame-budget failure, open plan observations, and renderer frame-hash substitution. Native/WASI fixtures exercise the complete graphics package and all three failing golden, pixel-golden, and frame-budget packages. Runtime fixtures execute from isolated temporary copies so effectful tests cannot mutate the normative source corpus. Preflight controls cover fail-fast stage precedence, open observations, request/result tampering, rejected package memory limits, missing capability policies, and exact artifact identity under distinct absolute workspace roots. Native/WASI fixtures include authentic module-hash and package-memory-limit failures.

Completion And Nonclaims

All twenty governed obligation kinds now have a closed primitive-fact contract, strict production decoder, no reachable host decision fallback, and native/WASI runtime coverage under one reviewed profile identity. This profile can support SD-OBLIGATION at H2 after the semantic-ownership ledger and its generated views independently validate the same source and evidence identities. Aggregate planning and acceptance remain GenesisCode-authored throughout. This contract does not close R4.2.d by itself and claims no effect-policy, effect-replay execution, signing, evidence-verification, bootstrap-fixpoint, release, or downstream product authority.