Symbol reference

Every symbol in the frozen GenesisCode agent profile.

Frozen symbol inventory

176 symbols · profile GC-AGENT-v0.3 · identity 7a0c9e3df7bc0ca7f93fb5481f05bab5bfd78d0ea282f9e9a3b7eb1d94368ad6

This page is generated from the closed agent symbol index. Search by exact spelling; symbol names are case-sensitive.

Symbol	Kind	Signature	Domain
.gclog	identifier	stable profile identifier: .gclog	effects
::meta	declaration	module declaration or metadata key: ::meta	modules
:caps	declaration	module declaration or metadata key: :caps	modules
:exports	declaration	module declaration or metadata key: :exports	modules
:types	declaration	module declaration or metadata key: :types	modules
BadForm	identifier	stable profile identifier: BadForm	errors
Bool	value-kind	runtime/coreform value kind: Bool	coreform-mapping
Bytes	value-kind	runtime/coreform value kind: Bytes	coreform-mapping
Closure	value-kind	runtime/coreform value kind: Closure	values
CompiledClosure	value-kind	runtime/coreform value kind: CompiledClosure	values
Contract	value-kind	runtime/coreform value kind: Contract	values
Data	value-kind	runtime/coreform value kind: Data	values
EFFECT	identifier	stable profile identifier: EFFECT	errors
ERROR	identifier	stable profile identifier: ERROR	errors
EffectProgram	value-kind	runtime/coreform value kind: EffectProgram	values
EffectRequest	value-kind	runtime/coreform value kind: EffectRequest	values
GC-AGENT-v0.3	identifier	stable profile identifier: GC-AGENT-v0.3	compatibility-identifiers
Int	value-kind	runtime/coreform value kind: Int	coreform-mapping, values
Internal	identifier	stable profile identifier: Internal	errors
Map	value-kind	runtime/coreform value kind: Map	coreform-mapping, values
MemoryLimit	identifier	stable profile identifier: MemoryLimit	errors
NativeFn	value-kind	runtime/coreform value kind: NativeFn	values
Nil	value-kind	runtime/coreform value kind: Nil	coreform-mapping
NotCallable	identifier	stable profile identifier: NotCallable	errors
Pair	value-kind	runtime/coreform value kind: Pair	coreform-mapping
SealToken	value-kind	runtime/coreform value kind: SealToken	values
Sealed	value-kind	runtime/coreform value kind: Sealed	values
StepLimit	identifier	stable profile identifier: StepLimit	errors
Str	value-kind	runtime/coreform value kind: Str	coreform-mapping
Symbol	value-kind	runtime/coreform value kind: Symbol	coreform-mapping
Type	identifier	stable profile identifier: Type	errors
UNHANDLED	identifier	stable profile identifier: UNHANDLED	errors
Unbound	identifier	stable profile identifier: Unbound	errors
Vector	value-kind	runtime/coreform value kind: Vector	coreform-mapping, values
allow_unlimited	policy-field	reviewed manifest/policy field: allow_unlimited	resource-limits
application	form	(callable argument…) -> Value; source n-ary sugar is curried	evaluation
begin	form	(begin expression…) -> Value; evaluates left-to-right	evaluation
budgets	policy-field	reviewed manifest/policy field: budgets	packages
bytes	literal	reader-form bytes -> CoreForm	lexical-grammar
bytes/concat	callable	(prim bytes/concat arg1:Bytes arg2:Bytes) -> Bytes	values
bytes/from-hex	callable	(prim bytes/from-hex arg1:Str) -> Bytes	values
bytes/get	callable	(prim bytes/get arg1:Bytes arg2:Int) -> Int|Nil	values
bytes/join	callable	(prim bytes/join arg1:Bytes arg2:Vector) -> Bytes	values
bytes/len	callable	(prim bytes/len arg1:Bytes) -> Int	values
bytes/slice	callable	(prim bytes/slice arg1:Bytes arg2:Int arg3:Int) -> Bytes	values
bytes/to-hex	callable	(prim bytes/to-hex arg1:Bytes) -> Str	values
bytes/to-str-utf8	callable	(prim bytes/to-str-utf8 arg1:Bytes) -> Str	values
caps.toml	identifier	stable profile identifier: caps.toml	effects
caps_policy	policy-field	reviewed manifest/policy field: caps_policy	packages
comment	literal	reader-form comment -> CoreForm	lexical-grammar
core/contract::dispatch	callable	(core/contract::dispatch arg1:Contract arg2:Message) -> Value|UNHANDLED	contracts
core/contract::explain	callable	(core/contract::explain arg1:Contract arg2:Message) -> Map	contracts
core/contract::extend	callable	(core/contract::extend arg1:Contract arg2:Map<Symbol,Handler> arg3:Map) -> Contract	contracts
core/contract::genesis	identifier	stable profile identifier: core/contract::genesis	contracts
core/contract::make	callable	(core/contract::make arg1:Contract|Nil arg2:Map<Symbol,Handler> arg3:Map) -> Contract	contracts
core/contract::meta	callable	(core/contract::meta arg1:Contract) -> Map	contracts
core/contract::proto	callable	(core/contract::proto arg1:Contract) -> Contract|Nil	contracts
core/contract::shape	callable	(core/contract::shape arg1:Contract) -> Bytes32	contracts
core/effect::bind	callable	(core/effect::bind arg1:EffectProgram arg2:Fn<A,EffectProgram>) -> EffectProgram	effects
core/effect::catch	callable	(core/effect::catch arg1:EffectProgram arg2:Fn<ERROR,EffectProgram>) -> EffectProgram	effects
core/effect::catch-payload	callable	(core/effect::catch-payload arg1:EffectProgram arg2:Fn<Data,EffectProgram>) -> EffectProgram	effects
core/effect::map	callable	(core/effect::map arg1:EffectProgram arg2:Fn<A,B>) -> EffectProgram	effects
core/effect::perform	callable	(core/effect::perform arg1:Symbol arg2:Data arg3:Map) -> EffectProgram	effects
core/effect::pure	callable	(core/effect::pure arg1:Value) -> EffectProgram	effects
core/effect::then	callable	(core/effect::then arg1:EffectProgram arg2:EffectProgram) -> EffectProgram	effects
core/eq?	callable	(prim core/eq? arg1:Value arg2:Value) -> Bool	values
core/msg::make	callable	(core/msg::make arg1:Symbol arg2:Data) -> Message	contracts
core/msg::op	callable	(core/msg::op arg1:Message) -> Symbol	contracts
core/msg::payload	callable	(core/msg::payload arg1:Message) -> Data	contracts
coreform/escape-bytes	callable	(prim coreform/escape-bytes arg1:Bytes) -> Str	values
coreform/escape-str	callable	(prim coreform/escape-str arg1:Str) -> Str	values
crypto/blake3	callable	(prim crypto/blake3 arg1:Bytes) -> Bytes32	values
data/tag	callable	(prim data/tag arg1:Data) -> Symbol	values
dec/add	callable	(prim dec/add arg1:Dec arg2:Dec) -> Dec	values
dec/eq?	callable	(prim dec/eq? arg1:Dec arg2:Dec) -> Bool	values
dec/from-int	callable	(prim dec/from-int arg1:Int) -> Dec	values
dec/lt?	callable	(prim dec/lt? arg1:Dec arg2:Dec) -> Bool	values
dec/mul	callable	(prim dec/mul arg1:Dec arg2:Dec) -> Dec	values
dec/parse	callable	(prim dec/parse arg1:Str) -> Dec	values
dec/sub	callable	(prim dec/sub arg1:Dec arg2:Dec) -> Dec	values
dec/to-str	callable	(prim dec/to-str arg1:Dec) -> Str	values
def	form	(def name expression) -> module binding; top-level only	evaluation, modules
dependencies	policy-field	reviewed manifest/policy field: dependencies	packages
false	literal	reader-form false -> CoreForm	lexical-grammar
fn	form	(fn (parameter…) body…) -> Closure	evaluation
genesis-lock-v2	identifier	stable profile identifier: genesis-lock-v2	compatibility-identifiers
genesis/coreform/v0.2	identifier	stable profile identifier: genesis/coreform/v0.2	compatibility-identifiers
genesis/diagnostic-catalog-v0.1	identifier	stable profile identifier: genesis/diagnostic-catalog-v0.1	errors
genesis/diagnostic/v1	identifier	stable profile identifier: genesis/diagnostic/v1	errors
genesis/diagnostics-schema-v1	identifier	stable profile identifier: genesis/diagnostics-schema-v1	errors, compatibility-identifiers
genesis/effect-log/v3	identifier	stable profile identifier: genesis/effect-log/v3	compatibility-identifiers
genesis/error-v0.2	identifier	stable profile identifier: genesis/error-v0.2	errors, compatibility-identifiers
genesis/hash-profile/gcv0.2-blake3	identifier	stable profile identifier: genesis/hash-profile/gcv0.2-blake3	compatibility-identifiers
genesis/language-profile/v0.2	identifier	stable profile identifier: genesis/language-profile/v0.2	compatibility-identifiers
genesis/value-effect-hash/v0.2	identifier	stable profile identifier: genesis/value-effect-hash/v0.2	compatibility-identifiers
gfx	policy-field	reviewed manifest/policy field: gfx	packages
gpk-v2	identifier	stable profile identifier: gpk-v2	compatibility-identifiers
if	form	(if condition then else) -> Value; exactly one branch is evaluated	evaluation
int/add	callable	(prim int/add arg1:Int arg2:Int) -> Int	values
int/div	callable	(prim int/div arg1:Int arg2:Int) -> Int	values
int/eq?	callable	(prim int/eq? arg1:Int arg2:Int) -> Bool	values
int/lt?	callable	(prim int/lt? arg1:Int arg2:Int) -> Bool	values
int/mod	callable	(prim int/mod arg1:Int arg2:Int) -> Int	values
int/mul	callable	(prim int/mul arg1:Int arg2:Int) -> Int	values
int/sub	callable	(prim int/sub arg1:Int arg2:Int) -> Int	values
int/to-str	callable	(prim int/to-str arg1:Int) -> Str	values
integer	literal	reader-form integer -> CoreForm	lexical-grammar
let	form	(let ((name expression)…) body…) -> Value	evaluation
limits	policy-field	reviewed manifest/policy field: limits	packages
list	literal	reader-form list -> CoreForm	lexical-grammar
list/is-nil?	callable	(prim list/is-nil? arg1:Data) -> Bool	values
map	literal	reader-form map -> CoreForm	lexical-grammar
map/entries	callable	(prim map/entries arg1:Map) -> Vector<[Data Data]>	values
map/from-entries	callable	(prim map/from-entries arg1:Vector<[Data Data]>) -> Map	values
map/get	callable	(prim map/get arg1:Map arg2:Data) -> Value|Nil	values
map/len	callable	(prim map/len arg1:Map) -> Int	values
map/merge	callable	(prim map/merge arg1:Map arg2:Map) -> Map	values
map/put	callable	(prim map/put arg1:Map arg2:Data arg3:Value) -> Map	values
max_alloc_units	policy-field	reviewed manifest/policy field: max_alloc_units	resource-limits
max_bytes_len	policy-field	reviewed manifest/policy field: max_bytes_len	resource-limits
max_effect_entries_per_test	policy-field	reviewed manifest/policy field: max_effect_entries_per_test	resource-limits
max_effect_log_bytes_per_test	policy-field	reviewed manifest/policy field: max_effect_log_bytes_per_test	resource-limits
max_effect_ops	policy-field	reviewed manifest/policy field: max_effect_ops	resource-limits
max_live_units	policy-field	reviewed manifest/policy field: max_live_units	resource-limits
max_map_len	policy-field	reviewed manifest/policy field: max_map_len	resource-limits
max_pair_cells	policy-field	reviewed manifest/policy field: max_pair_cells	resource-limits
max_payload_bytes_per_op	policy-field	reviewed manifest/policy field: max_payload_bytes_per_op	resource-limits
max_payload_bytes_per_run	policy-field	reviewed manifest/policy field: max_payload_bytes_per_run	resource-limits
max_response_bytes_per_op	policy-field	reviewed manifest/policy field: max_response_bytes_per_op	resource-limits
max_response_bytes_per_run	policy-field	reviewed manifest/policy field: max_response_bytes_per_run	resource-limits
max_steps_per_test	policy-field	reviewed manifest/policy field: max_steps_per_test	resource-limits
max_string_len	policy-field	reviewed manifest/policy field: max_string_len	resource-limits
max_vec_len	policy-field	reviewed manifest/policy field: max_vec_len	resource-limits
module-path::name	declaration	module declaration or metadata key: module-path::name	modules
modules	policy-field	reviewed manifest/policy field: modules	packages
name	policy-field	reviewed manifest/policy field: name	packages
nil	literal	reader-form nil -> CoreForm	lexical-grammar
obligations	policy-field	reviewed manifest/policy field: obligations	packages
package-schema-1	identifier	stable profile identifier: package-schema-1	compatibility-identifiers
pair/as-proper-list	callable	(prim pair/as-proper-list arg1:Pair|Nil) -> Vector|Nil	values
pair/car	callable	(prim pair/car arg1:Pair) -> Data	values
pair/cdr	callable	(prim pair/cdr arg1:Pair) -> Data	values
pair/cons	callable	(prim pair/cons arg1:Data arg2:Data) -> Pair	values
prim	form	(prim primitive-name argument…) -> Value	evaluation
property	policy-field	reviewed manifest/policy field: property	packages
property_tests	policy-field	reviewed manifest/policy field: property_tests	packages
quote	form	(quote datum) -> Data; datum is not evaluated	lexical-grammar, evaluation
replay	identifier	stable profile identifier: replay	effects
reserved-not-stable	identifier	stable profile identifier: reserved-not-stable	compatibility-identifiers
schema	policy-field	reviewed manifest/policy field: schema	packages
seal	form	(seal token value) -> Sealed	evaluation
step_limit	policy-field	reviewed manifest/policy field: step_limit	resource-limits
str/concat	callable	(prim str/concat arg1:Str arg2:Str) -> Str	values
str/grapheme-len	callable	(prim str/grapheme-len arg1:Str) -> Int	values
str/grapheme-slice	callable	(prim str/grapheme-slice arg1:Str arg2:Int arg3:Int) -> Str	values
str/join	callable	(prim str/join arg1:Str arg2:Vector) -> Str	values
str/len	callable	(prim str/len arg1:Str) -> Int	values
str/nfc	callable	(prim str/nfc arg1:Str) -> Str	values
str/repeat	callable	(prim str/repeat arg1:Str arg2:Int) -> Str	values
str/scalar-len	callable	(prim str/scalar-len arg1:Str) -> Int	values
str/to-bytes-utf8	callable	(prim str/to-bytes-utf8 arg1:Str) -> Bytes	values
string	literal	reader-form string -> CoreForm	lexical-grammar
sym/eq?	callable	(prim sym/eq? arg1:Symbol arg2:Symbol) -> Bool	values
sym/from-str	callable	(prim sym/from-str arg1:Str) -> Symbol	values
sym/to-str	callable	(prim sym/to-str arg1:Symbol) -> Str	values
symbol	literal	reader-form symbol -> CoreForm	lexical-grammar
tests	policy-field	reviewed manifest/policy field: tests	packages
true	literal	reader-form true -> CoreForm	lexical-grammar
unseal	form	(unseal token sealed-value) -> Value|Nil	evaluation
utf8/encode-codepoint	callable	(prim utf8/encode-codepoint arg1:Int) -> Bytes	values
vec/get	callable	(prim vec/get arg1:Vector arg2:Int) -> Value|Nil	values
vec/len	callable	(prim vec/len arg1:Vector) -> Int	values
vec/push	callable	(prim vec/push arg1:Vector arg2:Value) -> Vector	values
vec/set	callable	(prim vec/set arg1:Vector arg2:Int arg3:Value) -> Vector	values
vector	literal	reader-form vector -> CoreForm	lexical-grammar
version	policy-field	reviewed manifest/policy field: version	packages

.gclog

profile-selected

Signature: stable profile identifier: .gclog

Domains: effects
Effects: records deterministic runner effects
Capabilities: artifact write capability during run only
Diagnostics: EFFECT, ERROR, replay/mismatch, caps/denied

Contracts and examples

Contracts

• Effects are explicit Pure or Perform programs; kernel evaluation performs no host operation.
• The host runner denies every operation absent from caps.toml and records deterministic replay facts.
• Replay consumes entries in order and rejects operation, hash, decision, capability, or scheduler mismatch.

Examples

• usage-template: stable profile identifier: .gclog → Identifier

Sources

• crates/gc_prelude/src/prelude.rs: core/effect::pure, core/effect::perform, core/effect::bind
• docs/spec/SEALS_DISPATCH_REPLAY.md: Runner is deny-by-default, Every performed effect appends a deterministic log entry

::meta

core

Signature: module declaration or metadata key: ::meta

Domains: modules
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound

Contracts and examples

Contracts

• A module is an ordered sequence of CoreForm forms with top-level def bindings.
• Exported symbols use module-path::name and package metadata declares :caps, :exports, and :types.
• Canonical module hashing is independent of absolute filesystem paths.

Examples

• usage-template: module declaration or metadata key: ::meta → ModuleMetadata|Binding

Sources

• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, fn parse_def
• docs/spec/MODULE_SCOPE.md: A module is a vector/list of CoreForm terms evaluated left-to-right., def` is only recognized at the top level

:caps

core

Signature: module declaration or metadata key: :caps

Domains: modules
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound

Contracts and examples

Contracts

• A module is an ordered sequence of CoreForm forms with top-level def bindings.
• Exported symbols use module-path::name and package metadata declares :caps, :exports, and :types.
• Canonical module hashing is independent of absolute filesystem paths.

Examples

• usage-template: module declaration or metadata key: :caps → ModuleMetadata|Binding

Sources

• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, fn parse_def
• docs/spec/MODULE_SCOPE.md: A module is a vector/list of CoreForm terms evaluated left-to-right., def` is only recognized at the top level

:exports

core

Signature: module declaration or metadata key: :exports

Domains: modules
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound

Contracts and examples

Contracts

• A module is an ordered sequence of CoreForm forms with top-level def bindings.
• Exported symbols use module-path::name and package metadata declares :caps, :exports, and :types.
• Canonical module hashing is independent of absolute filesystem paths.

Examples

• usage-template: module declaration or metadata key: :exports → ModuleMetadata|Binding

Sources

• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, fn parse_def
• docs/spec/MODULE_SCOPE.md: A module is a vector/list of CoreForm terms evaluated left-to-right., def` is only recognized at the top level

:types

core

Signature: module declaration or metadata key: :types

Domains: modules
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound

Contracts and examples

Contracts

• A module is an ordered sequence of CoreForm forms with top-level def bindings.
• Exported symbols use module-path::name and package metadata declares :caps, :exports, and :types.
• Canonical module hashing is independent of absolute filesystem paths.

Examples

• usage-template: module declaration or metadata key: :types → ModuleMetadata|Binding

Sources

• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, fn parse_def
• docs/spec/MODULE_SCOPE.md: A module is a vector/list of CoreForm terms evaluated left-to-right., def` is only recognized at the top level

BadForm

core

Signature: stable profile identifier: BadForm

Domains: errors
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.

Examples

• usage-template: stable profile identifier: BadForm → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing

Bool

core

Signature: runtime/coreform value kind: Bool

Domains: coreform-mapping
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, MemoryLimit

Contracts and examples

Contracts

• Source atoms and collections map to the nine canonical Term variants.
• Lists are proper Pair/Nil chains and maps use deterministic structural key ordering.
• Canonical identity uses genesis/hash-profile/gcv0.2-blake3 and GCv0.2 NUL domain separation.

Examples

• usage-template: runtime/coreform value kind: Bool → Bool

Sources

• crates/gc_coreform/src/term.rs: pub const COREFORM_PROFILE_ID, pub enum Term, Term::Map, HASH_DOMAIN_PREFIX

Bytes

core

Signature: runtime/coreform value kind: Bytes

Domains: coreform-mapping
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, MemoryLimit

Contracts and examples

Contracts

• Source atoms and collections map to the nine canonical Term variants.
• Lists are proper Pair/Nil chains and maps use deterministic structural key ordering.
• Canonical identity uses genesis/hash-profile/gcv0.2-blake3 and GCv0.2 NUL domain separation.

Examples

• usage-template: runtime/coreform value kind: Bytes → Bytes

Sources

• crates/gc_coreform/src/term.rs: pub const COREFORM_PROFILE_ID, pub enum Term, Term::Map, HASH_DOMAIN_PREFIX

Closure

core

Signature: runtime/coreform value kind: Closure

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: runtime/coreform value kind: Closure → Closure

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

CompiledClosure

core

Signature: runtime/coreform value kind: CompiledClosure

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: runtime/coreform value kind: CompiledClosure → CompiledClosure

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

Contract

core

Signature: runtime/coreform value kind: Contract

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: runtime/coreform value kind: Contract → Contract

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

Data

core

Signature: runtime/coreform value kind: Data

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: runtime/coreform value kind: Data → Data

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

EFFECT

core

Signature: stable profile identifier: EFFECT

Domains: errors
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.

Examples

• usage-template: stable profile identifier: EFFECT → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing

ERROR

core

Signature: stable profile identifier: ERROR

Domains: errors
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.

Examples

• usage-template: stable profile identifier: ERROR → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing

EffectProgram

core

Signature: runtime/coreform value kind: EffectProgram

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: runtime/coreform value kind: EffectProgram → EffectProgram

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

EffectRequest

core

Signature: runtime/coreform value kind: EffectRequest

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: runtime/coreform value kind: EffectRequest → EffectRequest

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

GC-AGENT-v0.3

core

Signature: stable profile identifier: GC-AGENT-v0.3

Domains: compatibility-identifiers
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: compatibility/unsupported-version

Contracts and examples

Contracts

• GC-AGENT-v0.3 names a training surface over the current v0.2 runtime identities; it does not rename serialized formats.
• All genesis/compat/v1 IDs remain permanently reserved but not stable until R9 freeze requirements pass.
• Unknown future discriminators fail closed and every accepted predecessor has a migration record.

Examples

• usage-template: stable profile identifier: GC-AGENT-v0.3 → Identifier

Sources

• genesis.version-surfaces.json: release_train, canonical-hash-profile, effect-log
• genesis.compatibility.json: reserved-not-stable, genesis/compat/v1/language-profile, genesis/compat/v1/bytecode

Int

core

Signature: runtime/coreform value kind: Int

Domains: coreform-mapping, values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, MemoryLimit, Type

Contracts and examples

Contracts

• Source atoms and collections map to the nine canonical Term variants.
• Lists are proper Pair/Nil chains and maps use deterministic structural key ordering.
• Canonical identity uses genesis/hash-profile/gcv0.2-blake3 and GCv0.2 NUL domain separation.
• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: runtime/coreform value kind: Int → Int

Sources

• crates/gc_coreform/src/term.rs: pub const COREFORM_PROFILE_ID, pub enum Term, Term::Map, HASH_DOMAIN_PREFIX
• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

Internal

core

Signature: stable profile identifier: Internal

Domains: errors
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.

Examples

• usage-template: stable profile identifier: Internal → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing

Map

core

Signature: runtime/coreform value kind: Map

Domains: coreform-mapping, values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, MemoryLimit, Type

Contracts and examples

Contracts

• Source atoms and collections map to the nine canonical Term variants.
• Lists are proper Pair/Nil chains and maps use deterministic structural key ordering.
• Canonical identity uses genesis/hash-profile/gcv0.2-blake3 and GCv0.2 NUL domain separation.
• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: runtime/coreform value kind: Map → Map

Sources

• crates/gc_coreform/src/term.rs: pub const COREFORM_PROFILE_ID, pub enum Term, Term::Map, HASH_DOMAIN_PREFIX
• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

MemoryLimit

core

Signature: stable profile identifier: MemoryLimit

Domains: errors
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.

Examples

• usage-template: stable profile identifier: MemoryLimit → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing

NativeFn

core

Signature: runtime/coreform value kind: NativeFn

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: runtime/coreform value kind: NativeFn → NativeFn

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

Nil

core

Signature: runtime/coreform value kind: Nil

Domains: coreform-mapping
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, MemoryLimit

Contracts and examples

Contracts

• Source atoms and collections map to the nine canonical Term variants.
• Lists are proper Pair/Nil chains and maps use deterministic structural key ordering.
• Canonical identity uses genesis/hash-profile/gcv0.2-blake3 and GCv0.2 NUL domain separation.

Examples

• usage-template: runtime/coreform value kind: Nil → Nil

Sources

• crates/gc_coreform/src/term.rs: pub const COREFORM_PROFILE_ID, pub enum Term, Term::Map, HASH_DOMAIN_PREFIX

NotCallable

core

Signature: stable profile identifier: NotCallable

Domains: errors
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.

Examples

• usage-template: stable profile identifier: NotCallable → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing

Pair

core

Signature: runtime/coreform value kind: Pair

Domains: coreform-mapping
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, MemoryLimit

Contracts and examples

Contracts

• Source atoms and collections map to the nine canonical Term variants.
• Lists are proper Pair/Nil chains and maps use deterministic structural key ordering.
• Canonical identity uses genesis/hash-profile/gcv0.2-blake3 and GCv0.2 NUL domain separation.

Examples

• usage-template: runtime/coreform value kind: Pair → Pair

Sources

• crates/gc_coreform/src/term.rs: pub const COREFORM_PROFILE_ID, pub enum Term, Term::Map, HASH_DOMAIN_PREFIX

SealToken

core

Signature: runtime/coreform value kind: SealToken

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: runtime/coreform value kind: SealToken → SealToken

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

Sealed

core

Signature: runtime/coreform value kind: Sealed

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: runtime/coreform value kind: Sealed → Sealed

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

StepLimit

core

Signature: stable profile identifier: StepLimit

Domains: errors
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.

Examples

• usage-template: stable profile identifier: StepLimit → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing

Str

core

Signature: runtime/coreform value kind: Str

Domains: coreform-mapping
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, MemoryLimit

Contracts and examples

Contracts

• Source atoms and collections map to the nine canonical Term variants.
• Lists are proper Pair/Nil chains and maps use deterministic structural key ordering.
• Canonical identity uses genesis/hash-profile/gcv0.2-blake3 and GCv0.2 NUL domain separation.

Examples

• usage-template: runtime/coreform value kind: Str → Str

Sources

• crates/gc_coreform/src/term.rs: pub const COREFORM_PROFILE_ID, pub enum Term, Term::Map, HASH_DOMAIN_PREFIX

Symbol

core

Signature: runtime/coreform value kind: Symbol

Domains: coreform-mapping
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, MemoryLimit

Contracts and examples

Contracts

• Source atoms and collections map to the nine canonical Term variants.
• Lists are proper Pair/Nil chains and maps use deterministic structural key ordering.
• Canonical identity uses genesis/hash-profile/gcv0.2-blake3 and GCv0.2 NUL domain separation.

Examples

• usage-template: runtime/coreform value kind: Symbol → Symbol

Sources

• crates/gc_coreform/src/term.rs: pub const COREFORM_PROFILE_ID, pub enum Term, Term::Map, HASH_DOMAIN_PREFIX

Type

core

Signature: stable profile identifier: Type

Domains: errors
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.

Examples

• usage-template: stable profile identifier: Type → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing

UNHANDLED

core

Signature: stable profile identifier: UNHANDLED

Domains: errors
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.

Examples

• usage-template: stable profile identifier: UNHANDLED → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing

Unbound

core

Signature: stable profile identifier: Unbound

Domains: errors
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.

Examples

• usage-template: stable profile identifier: Unbound → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing

Vector

core

Signature: runtime/coreform value kind: Vector

Domains: coreform-mapping, values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, MemoryLimit, Type

Contracts and examples

Contracts

• Source atoms and collections map to the nine canonical Term variants.
• Lists are proper Pair/Nil chains and maps use deterministic structural key ordering.
• Canonical identity uses genesis/hash-profile/gcv0.2-blake3 and GCv0.2 NUL domain separation.
• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: runtime/coreform value kind: Vector → Vector

Sources

• crates/gc_coreform/src/term.rs: pub const COREFORM_PROFILE_ID, pub enum Term, Term::Map, HASH_DOMAIN_PREFIX
• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

allow_unlimited

core

Signature: reviewed manifest/policy field: allow_unlimited

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• package-schema-1: schema = 1 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] [limits] step_limit = 1000 allow_unlimited = false → accept

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

application

core

Signature: (callable argument...) -> Value; source n-ary sugar is curried

Domains: evaluation
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound, NotCallable, StepLimit, MemoryLimit

Contracts and examples

Contracts

• Evaluation is pure and deterministic inside the kernel.
• def is valid only at module top level; fn and application accept source-level n-ary sugar but evaluate as curried application.
• if, begin, let, and the final closure application are tail-position aware.
• Map keys are data and map values are evaluated expressions.

Examples

• usage-template: (callable argument...) -> Value; source n-ary sugar is curried → Value; source n-ary sugar is curried

Sources

• crates/gc_kernel/src/eval_treewalk.rs: Special forms keyed by head symbol, “quote” =>, “fn” =>, “if” =>, “begin” =>, “let” =>, “prim” =>, “seal” =>, “unseal” =>
• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, parse_def, Desugar multi-arg lambda into nested unary closures

begin

core

Signature: (begin expression...) -> Value; evaluates left-to-right

Domains: evaluation
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound, NotCallable, StepLimit, MemoryLimit

Contracts and examples

Contracts

• Evaluation is pure and deterministic inside the kernel.
• def is valid only at module top level; fn and application accept source-level n-ary sugar but evaluate as curried application.
• if, begin, let, and the final closure application are tail-position aware.
• Map keys are data and map values are evaluated expressions.

Examples

• step-limit: (begin 1 2 3 4) → StepLimit

Sources

• crates/gc_kernel/src/eval_treewalk.rs: Special forms keyed by head symbol, “quote” =>, “fn” =>, “if” =>, “begin” =>, “let” =>, “prim” =>, “seal” =>, “unseal” =>
• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, parse_def, Desugar multi-arg lambda into nested unary closures

budgets

core

Signature: reviewed manifest/policy field: budgets

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• usage-template: reviewed manifest/policy field: budgets → ConfiguredValue

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced

bytes

core

Signature: reader-form bytes -> CoreForm

Domains: lexical-grammar
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm

Contracts and examples

Contracts

• Whitespace is space, tab, LF, or CR; semicolon comments end at LF.
• Integers are base-10 with an optional leading minus and arbitrary source precision.
• Strings and bytes support backslash, quote, n, r, t, xNN, and uNNNN escapes.
• A leading quote desugars exactly to (quote datum); colon-prefixed keywords remain symbols.

Examples

• usage-template: reader-form bytes -> CoreForm → CoreForm

Sources

• crates/gc_coreform/src/parse.rs: enum Tok, comment: ‘;’ to end of line, bytes literal: b”…“, Tok::Quote

bytes/concat

core

Signature: (prim bytes/concat arg1:Bytes arg2:Bytes) -> Bytes

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim bytes/concat arg1:Bytes arg2:Bytes) -> Bytes → Bytes

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

bytes/from-hex

core

Signature: (prim bytes/from-hex arg1:Str) -> Bytes

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim bytes/from-hex arg1:Str) -> Bytes → Bytes

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

bytes/get

core

Signature: (prim bytes/get arg1:Bytes arg2:Int) -> Int|Nil

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim bytes/get arg1:Bytes arg2:Int) -> Int|Nil → Int|Nil

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

bytes/join

core

Signature: (prim bytes/join arg1:Bytes arg2:Vector<Bytes>) -> Bytes

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim bytes/join arg1:Bytes arg2:Vector<Bytes>) -> Bytes → Bytes

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

bytes/len

core

Signature: (prim bytes/len arg1:Bytes) -> Int

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim bytes/len arg1:Bytes) -> Int → Int

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

bytes/slice

core

Signature: (prim bytes/slice arg1:Bytes arg2:Int arg3:Int) -> Bytes

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim bytes/slice arg1:Bytes arg2:Int arg3:Int) -> Bytes → Bytes

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

bytes/to-hex

core

Signature: (prim bytes/to-hex arg1:Bytes) -> Str

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim bytes/to-hex arg1:Bytes) -> Str → Str

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

bytes/to-str-utf8

core

Signature: (prim bytes/to-str-utf8 arg1:Bytes) -> Str

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim bytes/to-str-utf8 arg1:Bytes) -> Str → Str

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

caps.toml

profile-selected

Signature: stable profile identifier: caps.toml

Domains: effects
Effects: authorizes runner effects; has no kernel effect
Capabilities: explicit deny-by-default operation allowlist
Diagnostics: EFFECT, ERROR, replay/mismatch, caps/denied

Contracts and examples

Contracts

• Effects are explicit Pure or Perform programs; kernel evaluation performs no host operation.
• The host runner denies every operation absent from caps.toml and records deterministic replay facts.
• Replay consumes entries in order and rejects operation, hash, decision, capability, or scheduler mismatch.

Examples

• usage-template: stable profile identifier: caps.toml → Identifier

Sources

• crates/gc_prelude/src/prelude.rs: core/effect::pure, core/effect::perform, core/effect::bind
• docs/spec/SEALS_DISPATCH_REPLAY.md: Runner is deny-by-default, Every performed effect appends a deterministic log entry

caps_policy

core

Signature: reviewed manifest/policy field: caps_policy

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• usage-template: reviewed manifest/policy field: caps_policy → ConfiguredValue

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced

comment

core

Signature: reader-form comment -> CoreForm

Domains: lexical-grammar
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm

Contracts and examples

Contracts

• Whitespace is space, tab, LF, or CR; semicolon comments end at LF.
• Integers are base-10 with an optional leading minus and arbitrary source precision.
• Strings and bytes support backslash, quote, n, r, t, xNN, and uNNNN escapes.
• A leading quote desugars exactly to (quote datum); colon-prefixed keywords remain symbols.

Examples

• unicode-symbol-and-comment: ; comment λ/identity → accept

Sources

• crates/gc_coreform/src/parse.rs: enum Tok, comment: ‘;’ to end of line, bytes literal: b”…“, Tok::Quote

core/contract::dispatch

core

Signature: (core/contract::dispatch arg1:Contract arg2:Message) -> Value|UNHANDLED

Domains: contracts
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: Type, UNHANDLED, ERROR

Contracts and examples

Contracts

• Dispatch calls the current handler and follows proto only for the trusted sealed UNHANDLED result.
• Contract shape and identity are deterministic; explain reports the same dispatch path without broadening capability policy.
• Messages are canonical op/payload data created and inspected through core/msg bindings.

Examples

• usage-template: (core/contract::dispatch arg1:Contract arg2:Message) -> Value|UNHANDLED → Value|UNHANDLED

Sources

• crates/gc_prelude/src/prelude.rs: core/contract::make, core/contract::extend, core/contract::dispatch, core/contract::explain, core/contract::genesis
• crates/gc_kernel/src/value.rs: pub struct Contract, shape_id, contract_id

core/contract::explain

core

Signature: (core/contract::explain arg1:Contract arg2:Message) -> Map

Domains: contracts
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: Type, UNHANDLED, ERROR

Contracts and examples

Contracts

• Dispatch calls the current handler and follows proto only for the trusted sealed UNHANDLED result.
• Contract shape and identity are deterministic; explain reports the same dispatch path without broadening capability policy.
• Messages are canonical op/payload data created and inspected through core/msg bindings.

Examples

• usage-template: (core/contract::explain arg1:Contract arg2:Message) -> Map → Map

Sources

• crates/gc_prelude/src/prelude.rs: core/contract::make, core/contract::extend, core/contract::dispatch, core/contract::explain, core/contract::genesis
• crates/gc_kernel/src/value.rs: pub struct Contract, shape_id, contract_id

core/contract::extend

core

Signature: (core/contract::extend arg1:Contract arg2:Map<Symbol,Handler> arg3:Map) -> Contract

Domains: contracts
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: Type, UNHANDLED, ERROR

Contracts and examples

Contracts

• Dispatch calls the current handler and follows proto only for the trusted sealed UNHANDLED result.
• Contract shape and identity are deterministic; explain reports the same dispatch path without broadening capability policy.
• Messages are canonical op/payload data created and inspected through core/msg bindings.

Examples

• usage-template: (core/contract::extend arg1:Contract arg2:Map<Symbol,Handler> arg3:Map) -> Contract → Contract

Sources

• crates/gc_prelude/src/prelude.rs: core/contract::make, core/contract::extend, core/contract::dispatch, core/contract::explain, core/contract::genesis
• crates/gc_kernel/src/value.rs: pub struct Contract, shape_id, contract_id

core/contract::genesis

core

Signature: stable profile identifier: core/contract::genesis

Domains: contracts
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: Type, UNHANDLED, ERROR

Contracts and examples

Contracts

• Dispatch calls the current handler and follows proto only for the trusted sealed UNHANDLED result.
• Contract shape and identity are deterministic; explain reports the same dispatch path without broadening capability policy.
• Messages are canonical op/payload data created and inspected through core/msg bindings.

Examples

• eval-contract: core/contract::genesis → Contract

Sources

• crates/gc_prelude/src/prelude.rs: core/contract::make, core/contract::extend, core/contract::dispatch, core/contract::explain, core/contract::genesis
• crates/gc_kernel/src/value.rs: pub struct Contract, shape_id, contract_id

core/contract::make

core

Signature: (core/contract::make arg1:Contract|Nil arg2:Map<Symbol,Handler> arg3:Map) -> Contract

Domains: contracts
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: Type, UNHANDLED, ERROR

Contracts and examples

Contracts

• Dispatch calls the current handler and follows proto only for the trusted sealed UNHANDLED result.
• Contract shape and identity are deterministic; explain reports the same dispatch path without broadening capability policy.
• Messages are canonical op/payload data created and inspected through core/msg bindings.

Examples

• usage-template: (core/contract::make arg1:Contract|Nil arg2:Map<Symbol,Handler> arg3:Map) -> Contract → Contract

Sources

• crates/gc_prelude/src/prelude.rs: core/contract::make, core/contract::extend, core/contract::dispatch, core/contract::explain, core/contract::genesis
• crates/gc_kernel/src/value.rs: pub struct Contract, shape_id, contract_id

core/contract::meta

core

Signature: (core/contract::meta arg1:Contract) -> Map

Domains: contracts
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: Type, UNHANDLED, ERROR

Contracts and examples

Contracts

• Dispatch calls the current handler and follows proto only for the trusted sealed UNHANDLED result.
• Contract shape and identity are deterministic; explain reports the same dispatch path without broadening capability policy.
• Messages are canonical op/payload data created and inspected through core/msg bindings.

Examples

• usage-template: (core/contract::meta arg1:Contract) -> Map → Map

Sources

• crates/gc_prelude/src/prelude.rs: core/contract::make, core/contract::extend, core/contract::dispatch, core/contract::explain, core/contract::genesis
• crates/gc_kernel/src/value.rs: pub struct Contract, shape_id, contract_id

core/contract::proto

core

Signature: (core/contract::proto arg1:Contract) -> Contract|Nil

Domains: contracts
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: Type, UNHANDLED, ERROR

Contracts and examples

Contracts

• Dispatch calls the current handler and follows proto only for the trusted sealed UNHANDLED result.
• Contract shape and identity are deterministic; explain reports the same dispatch path without broadening capability policy.
• Messages are canonical op/payload data created and inspected through core/msg bindings.

Examples

• usage-template: (core/contract::proto arg1:Contract) -> Contract|Nil → Contract|Nil

Sources

• crates/gc_prelude/src/prelude.rs: core/contract::make, core/contract::extend, core/contract::dispatch, core/contract::explain, core/contract::genesis
• crates/gc_kernel/src/value.rs: pub struct Contract, shape_id, contract_id

core/contract::shape

core

Signature: (core/contract::shape arg1:Contract) -> Bytes32

Domains: contracts
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: Type, UNHANDLED, ERROR

Contracts and examples

Contracts

• Dispatch calls the current handler and follows proto only for the trusted sealed UNHANDLED result.
• Contract shape and identity are deterministic; explain reports the same dispatch path without broadening capability policy.
• Messages are canonical op/payload data created and inspected through core/msg bindings.

Examples

• usage-template: (core/contract::shape arg1:Contract) -> Bytes32 → Bytes32

Sources

• crates/gc_prelude/src/prelude.rs: core/contract::make, core/contract::extend, core/contract::dispatch, core/contract::explain, core/contract::genesis
• crates/gc_kernel/src/value.rs: pub struct Contract, shape_id, contract_id

core/effect::bind

profile-selected

Signature: (core/effect::bind arg1:EffectProgram<A> arg2:Fn<A,EffectProgram<B>>) -> EffectProgram<B>

Domains: effects
Effects: composes deferred effects; performs no host effect in the kernel
Capabilities: none
Diagnostics: EFFECT, ERROR, replay/mismatch, caps/denied

Contracts and examples

Contracts

• Effects are explicit Pure or Perform programs; kernel evaluation performs no host operation.
• The host runner denies every operation absent from caps.toml and records deterministic replay facts.
• Replay consumes entries in order and rejects operation, hash, decision, capability, or scheduler mismatch.

Examples

• usage-template: (core/effect::bind arg1:EffectProgram<A> arg2:Fn<A,EffectProgram<B>>) -> EffectProgram<B> → EffectProgram<B>

Sources

• crates/gc_prelude/src/prelude.rs: core/effect::pure, core/effect::perform, core/effect::bind
• docs/spec/SEALS_DISPATCH_REPLAY.md: Runner is deny-by-default, Every performed effect appends a deterministic log entry

core/effect::catch

profile-selected

Signature: (core/effect::catch arg1:EffectProgram<A> arg2:Fn<ERROR,EffectProgram<A>>) -> EffectProgram<A>

Domains: effects
Effects: handles a sealed deferred effect error
Capabilities: none
Diagnostics: EFFECT, ERROR, replay/mismatch, caps/denied

Contracts and examples

Contracts

• Effects are explicit Pure or Perform programs; kernel evaluation performs no host operation.
• The host runner denies every operation absent from caps.toml and records deterministic replay facts.
• Replay consumes entries in order and rejects operation, hash, decision, capability, or scheduler mismatch.

Examples

• usage-template: (core/effect::catch arg1:EffectProgram<A> arg2:Fn<ERROR,EffectProgram<A>>) -> EffectProgram<A> → EffectProgram<A>

Sources

• crates/gc_prelude/src/prelude.rs: core/effect::pure, core/effect::perform, core/effect::bind
• docs/spec/SEALS_DISPATCH_REPLAY.md: Runner is deny-by-default, Every performed effect appends a deterministic log entry

core/effect::catch-payload

profile-selected

Signature: (core/effect::catch-payload arg1:EffectProgram<A> arg2:Fn<Data,EffectProgram<A>>) -> EffectProgram<A>

Domains: effects
Effects: handles a sealed deferred effect error payload
Capabilities: none
Diagnostics: EFFECT, ERROR, replay/mismatch, caps/denied

Contracts and examples

Contracts

• Effects are explicit Pure or Perform programs; kernel evaluation performs no host operation.
• The host runner denies every operation absent from caps.toml and records deterministic replay facts.
• Replay consumes entries in order and rejects operation, hash, decision, capability, or scheduler mismatch.

Examples

• usage-template: (core/effect::catch-payload arg1:EffectProgram<A> arg2:Fn<Data,EffectProgram<A>>) -> EffectProgram<A> → EffectProgram<A>

Sources

• crates/gc_prelude/src/prelude.rs: core/effect::pure, core/effect::perform, core/effect::bind
• docs/spec/SEALS_DISPATCH_REPLAY.md: Runner is deny-by-default, Every performed effect appends a deterministic log entry

core/effect::map

profile-selected

Signature: (core/effect::map arg1:EffectProgram<A> arg2:Fn<A,B>) -> EffectProgram<B>

Domains: effects
Effects: maps a pure function over a deferred effect result
Capabilities: none
Diagnostics: EFFECT, ERROR, replay/mismatch, caps/denied

Contracts and examples

Contracts

• Effects are explicit Pure or Perform programs; kernel evaluation performs no host operation.
• The host runner denies every operation absent from caps.toml and records deterministic replay facts.
• Replay consumes entries in order and rejects operation, hash, decision, capability, or scheduler mismatch.

Examples

• usage-template: (core/effect::map arg1:EffectProgram<A> arg2:Fn<A,B>) -> EffectProgram<B> → EffectProgram<B>

Sources

• crates/gc_prelude/src/prelude.rs: core/effect::pure, core/effect::perform, core/effect::bind
• docs/spec/SEALS_DISPATCH_REPLAY.md: Runner is deny-by-default, Every performed effect appends a deterministic log entry

core/effect::perform

profile-selected

Signature: (core/effect::perform arg1:Symbol arg2:Data arg3:Map) -> EffectProgram<Value>

Domains: effects
Effects: describes one deferred host effect; execution is runner-mediated
Capabilities: capability named by the effect operation
Diagnostics: EFFECT, ERROR, replay/mismatch, caps/denied

Contracts and examples

Contracts

• Effects are explicit Pure or Perform programs; kernel evaluation performs no host operation.
• The host runner denies every operation absent from caps.toml and records deterministic replay facts.
• Replay consumes entries in order and rejects operation, hash, decision, capability, or scheduler mismatch.

Examples

• usage-template: (core/effect::perform arg1:Symbol arg2:Data arg3:Map) -> EffectProgram<Value> → EffectProgram<Value>

Sources

• crates/gc_prelude/src/prelude.rs: core/effect::pure, core/effect::perform, core/effect::bind
• docs/spec/SEALS_DISPATCH_REPLAY.md: Runner is deny-by-default, Every performed effect appends a deterministic log entry

core/effect::pure

profile-selected

Signature: (core/effect::pure arg1:Value) -> EffectProgram<Value>

Domains: effects
Effects: constructs a pure EffectProgram; performs no host effect
Capabilities: none
Diagnostics: EFFECT, ERROR, replay/mismatch, caps/denied

Contracts and examples

Contracts

• Effects are explicit Pure or Perform programs; kernel evaluation performs no host operation.
• The host runner denies every operation absent from caps.toml and records deterministic replay facts.
• Replay consumes entries in order and rejects operation, hash, decision, capability, or scheduler mismatch.

Examples

• eval-effect-program: (core/effect::pure 1) → EffectProgram

Sources

• crates/gc_prelude/src/prelude.rs: core/effect::pure, core/effect::perform, core/effect::bind
• docs/spec/SEALS_DISPATCH_REPLAY.md: Runner is deny-by-default, Every performed effect appends a deterministic log entry

core/effect::then

profile-selected

Signature: (core/effect::then arg1:EffectProgram<A> arg2:EffectProgram<B>) -> EffectProgram<B>

Domains: effects
Effects: sequences deferred effect programs
Capabilities: none
Diagnostics: EFFECT, ERROR, replay/mismatch, caps/denied

Contracts and examples

Contracts

• Effects are explicit Pure or Perform programs; kernel evaluation performs no host operation.
• The host runner denies every operation absent from caps.toml and records deterministic replay facts.
• Replay consumes entries in order and rejects operation, hash, decision, capability, or scheduler mismatch.

Examples

• usage-template: (core/effect::then arg1:EffectProgram<A> arg2:EffectProgram<B>) -> EffectProgram<B> → EffectProgram<B>

Sources

• crates/gc_prelude/src/prelude.rs: core/effect::pure, core/effect::perform, core/effect::bind
• docs/spec/SEALS_DISPATCH_REPLAY.md: Runner is deny-by-default, Every performed effect appends a deterministic log entry

core/eq?

core

Signature: (prim core/eq? arg1:Value arg2:Value) -> Bool

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim core/eq? arg1:Value arg2:Value) -> Bool → Bool

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

core/msg::make

core

Signature: (core/msg::make arg1:Symbol arg2:Data) -> Message

Domains: contracts
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: Type, UNHANDLED, ERROR

Contracts and examples

Contracts

• Dispatch calls the current handler and follows proto only for the trusted sealed UNHANDLED result.
• Contract shape and identity are deterministic; explain reports the same dispatch path without broadening capability policy.
• Messages are canonical op/payload data created and inspected through core/msg bindings.

Examples

• usage-template: (core/msg::make arg1:Symbol arg2:Data) -> Message → Message

Sources

• crates/gc_prelude/src/prelude.rs: core/contract::make, core/contract::extend, core/contract::dispatch, core/contract::explain, core/contract::genesis
• crates/gc_kernel/src/value.rs: pub struct Contract, shape_id, contract_id

core/msg::op

core

Signature: (core/msg::op arg1:Message) -> Symbol

Domains: contracts
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: Type, UNHANDLED, ERROR

Contracts and examples

Contracts

• Dispatch calls the current handler and follows proto only for the trusted sealed UNHANDLED result.
• Contract shape and identity are deterministic; explain reports the same dispatch path without broadening capability policy.
• Messages are canonical op/payload data created and inspected through core/msg bindings.

Examples

• usage-template: (core/msg::op arg1:Message) -> Symbol → Symbol

Sources

• crates/gc_prelude/src/prelude.rs: core/contract::make, core/contract::extend, core/contract::dispatch, core/contract::explain, core/contract::genesis
• crates/gc_kernel/src/value.rs: pub struct Contract, shape_id, contract_id

core/msg::payload

core

Signature: (core/msg::payload arg1:Message) -> Data

Domains: contracts
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: Type, UNHANDLED, ERROR

Contracts and examples

Contracts

• Dispatch calls the current handler and follows proto only for the trusted sealed UNHANDLED result.
• Contract shape and identity are deterministic; explain reports the same dispatch path without broadening capability policy.
• Messages are canonical op/payload data created and inspected through core/msg bindings.

Examples

• usage-template: (core/msg::payload arg1:Message) -> Data → Data

Sources

• crates/gc_prelude/src/prelude.rs: core/contract::make, core/contract::extend, core/contract::dispatch, core/contract::explain, core/contract::genesis
• crates/gc_kernel/src/value.rs: pub struct Contract, shape_id, contract_id

coreform/escape-bytes

core

Signature: (prim coreform/escape-bytes arg1:Bytes) -> Str

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim coreform/escape-bytes arg1:Bytes) -> Str → Str

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

coreform/escape-str

core

Signature: (prim coreform/escape-str arg1:Str) -> Str

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim coreform/escape-str arg1:Str) -> Str → Str

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

crypto/blake3

core

Signature: (prim crypto/blake3 arg1:Bytes) -> Bytes32

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim crypto/blake3 arg1:Bytes) -> Bytes32 → Bytes32

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

data/tag

core

Signature: (prim data/tag arg1:Data) -> Symbol

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim data/tag arg1:Data) -> Symbol → Symbol

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

dec/add

core

Signature: (prim dec/add arg1:Dec arg2:Dec) -> Dec

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim dec/add arg1:Dec arg2:Dec) -> Dec → Dec

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

dec/eq?

core

Signature: (prim dec/eq? arg1:Dec arg2:Dec) -> Bool

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim dec/eq? arg1:Dec arg2:Dec) -> Bool → Bool

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

dec/from-int

core

Signature: (prim dec/from-int arg1:Int) -> Dec

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim dec/from-int arg1:Int) -> Dec → Dec

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

dec/lt?

core

Signature: (prim dec/lt? arg1:Dec arg2:Dec) -> Bool

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim dec/lt? arg1:Dec arg2:Dec) -> Bool → Bool

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

dec/mul

core

Signature: (prim dec/mul arg1:Dec arg2:Dec) -> Dec

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim dec/mul arg1:Dec arg2:Dec) -> Dec → Dec

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

dec/parse

core

Signature: (prim dec/parse arg1:Str) -> Dec

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim dec/parse arg1:Str) -> Dec → Dec

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

dec/sub

core

Signature: (prim dec/sub arg1:Dec arg2:Dec) -> Dec

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim dec/sub arg1:Dec arg2:Dec) -> Dec → Dec

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

dec/to-str

core

Signature: (prim dec/to-str arg1:Dec) -> Str

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim dec/to-str arg1:Dec) -> Str → Str

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

def

core

Signature: (def name expression) -> module binding; top-level only

Domains: evaluation, modules
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound, NotCallable, StepLimit, MemoryLimit

Contracts and examples

Contracts

• Evaluation is pure and deterministic inside the kernel.
• def is valid only at module top level; fn and application accept source-level n-ary sugar but evaluate as curried application.
• if, begin, let, and the final closure application are tail-position aware.
• Map keys are data and map values are evaluated expressions.
• A module is an ordered sequence of CoreForm forms with top-level def bindings.
• Exported symbols use module-path::name and package metadata declares :caps, :exports, and :types.
• Canonical module hashing is independent of absolute filesystem paths.

Examples

• usage-template: (def name expression) -> module binding; top-level only → module binding; top-level only

Sources

• crates/gc_kernel/src/eval_treewalk.rs: Special forms keyed by head symbol, “quote” =>, “fn” =>, “if” =>, “begin” =>, “let” =>, “prim” =>, “seal” =>, “unseal” =>
• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, parse_def, Desugar multi-arg lambda into nested unary closures
• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, fn parse_def
• docs/spec/MODULE_SCOPE.md: A module is a vector/list of CoreForm terms evaluated left-to-right., def` is only recognized at the top level

dependencies

core

Signature: reviewed manifest/policy field: dependencies

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• package-schema-1: schema = 1 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] [limits] step_limit = 1000 allow_unlimited = false → accept
• package-future-schema: schema = 2 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] → reject
• package-path-escape: schema = 1 name = "agent-profile" version = "0.0.0" dependencies = [] obligations = [] [[modules]] path = "../escape.gc" → reject

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced

false

core

Signature: reader-form false -> CoreForm

Domains: lexical-grammar
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm

Contracts and examples

Contracts

• Whitespace is space, tab, LF, or CR; semicolon comments end at LF.
• Integers are base-10 with an optional leading minus and arbitrary source precision.
• Strings and bytes support backslash, quote, n, r, t, xNN, and uNNNN escapes.
• A leading quote desugars exactly to (quote datum); colon-prefixed keywords remain symbols.

Examples

• lexical-atoms: nil true false 0 -1 "x\n" b"\x41" symbol :keyword → accept
• package-schema-1: schema = 1 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] [limits] step_limit = 1000 allow_unlimited = false → accept

Sources

• crates/gc_coreform/src/parse.rs: enum Tok, comment: ‘;’ to end of line, bytes literal: b”…“, Tok::Quote

fn

core

Signature: (fn (parameter...) body...) -> Closure

Domains: evaluation
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound, NotCallable, StepLimit, MemoryLimit

Contracts and examples

Contracts

• Evaluation is pure and deterministic inside the kernel.
• def is valid only at module top level; fn and application accept source-level n-ary sugar but evaluate as curried application.
• if, begin, let, and the final closure application are tail-position aware.
• Map keys are data and map values are evaluated expressions.

Examples

• eval-lexical-closure: (let ((x 2)) ((fn (y) (prim int/mul x y)) 3)) → 6

Sources

• crates/gc_kernel/src/eval_treewalk.rs: Special forms keyed by head symbol, “quote” =>, “fn” =>, “if” =>, “begin” =>, “let” =>, “prim” =>, “seal” =>, “unseal” =>
• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, parse_def, Desugar multi-arg lambda into nested unary closures

genesis-lock-v2

core

Signature: stable profile identifier: genesis-lock-v2

Domains: compatibility-identifiers
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: compatibility/unsupported-version

Contracts and examples

Contracts

• GC-AGENT-v0.3 names a training surface over the current v0.2 runtime identities; it does not rename serialized formats.
• All genesis/compat/v1 IDs remain permanently reserved but not stable until R9 freeze requirements pass.
• Unknown future discriminators fail closed and every accepted predecessor has a migration record.

Examples

• usage-template: stable profile identifier: genesis-lock-v2 → Identifier

Sources

• genesis.version-surfaces.json: release_train, canonical-hash-profile, effect-log
• genesis.compatibility.json: reserved-not-stable, genesis/compat/v1/language-profile, genesis/compat/v1/bytecode

genesis/coreform/v0.2

core

Signature: stable profile identifier: genesis/coreform/v0.2

Domains: compatibility-identifiers
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: compatibility/unsupported-version

Contracts and examples

Contracts

• GC-AGENT-v0.3 names a training surface over the current v0.2 runtime identities; it does not rename serialized formats.
• All genesis/compat/v1 IDs remain permanently reserved but not stable until R9 freeze requirements pass.
• Unknown future discriminators fail closed and every accepted predecessor has a migration record.

Examples

• usage-template: stable profile identifier: genesis/coreform/v0.2 → Identifier

Sources

• genesis.version-surfaces.json: release_train, canonical-hash-profile, effect-log
• genesis.compatibility.json: reserved-not-stable, genesis/compat/v1/language-profile, genesis/compat/v1/bytecode

genesis/diagnostic-catalog-v0.1

core

Signature: stable profile identifier: genesis/diagnostic-catalog-v0.1

Domains: errors
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.

Examples

• usage-template: stable profile identifier: genesis/diagnostic-catalog-v0.1 → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing

genesis/diagnostic/v1

core

Signature: stable profile identifier: genesis/diagnostic/v1

Domains: errors
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.

Examples

• usage-template: stable profile identifier: genesis/diagnostic/v1 → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing

genesis/diagnostics-schema-v1

core

Signature: stable profile identifier: genesis/diagnostics-schema-v1

Domains: errors, compatibility-identifiers
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1, compatibility/unsupported-version

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.
• GC-AGENT-v0.3 names a training surface over the current v0.2 runtime identities; it does not rename serialized formats.
• All genesis/compat/v1 IDs remain permanently reserved but not stable until R9 freeze requirements pass.
• Unknown future discriminators fail closed and every accepted predecessor has a migration record.

Examples

• usage-template: stable profile identifier: genesis/diagnostics-schema-v1 → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing
• genesis.version-surfaces.json: release_train, canonical-hash-profile, effect-log
• genesis.compatibility.json: reserved-not-stable, genesis/compat/v1/language-profile, genesis/compat/v1/bytecode

genesis/effect-log/v3

core

Signature: stable profile identifier: genesis/effect-log/v3

Domains: compatibility-identifiers
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: compatibility/unsupported-version

Contracts and examples

Contracts

• GC-AGENT-v0.3 names a training surface over the current v0.2 runtime identities; it does not rename serialized formats.
• All genesis/compat/v1 IDs remain permanently reserved but not stable until R9 freeze requirements pass.
• Unknown future discriminators fail closed and every accepted predecessor has a migration record.

Examples

• usage-template: stable profile identifier: genesis/effect-log/v3 → Identifier

Sources

• genesis.version-surfaces.json: release_train, canonical-hash-profile, effect-log
• genesis.compatibility.json: reserved-not-stable, genesis/compat/v1/language-profile, genesis/compat/v1/bytecode

genesis/error-v0.2

core

Signature: stable profile identifier: genesis/error-v0.2

Domains: errors, compatibility-identifiers
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: genesis/error-v0.2, genesis/diagnostics-schema-v1, compatibility/unsupported-version

Contracts and examples

Contracts

• User input failures return explicit Rust Result internally, sealed ERROR values at runtime boundaries, or structured CLI diagnostics.
• UNHANDLED, EFFECT, and ERROR recognition requires trusted Prelude-created seals.
• CLI failures use genesis/error-v0.2 plus genesis/diagnostics-schema-v1 and stable nonzero exit classes.
• Every emitted CLI code resolves to one versioned genesis/diagnostic/v1 record with phase, span contract, structured parameters, causes, safe repairs, documentation, and source authorities; unknown codes fail closed.
• GC-AGENT-v0.3 names a training surface over the current v0.2 runtime identities; it does not rename serialized formats.
• All genesis/compat/v1 IDs remain permanently reserved but not stable until R9 freeze requirements pass.
• Unknown future discriminators fail closed and every accepted predecessor has a migration record.

Examples

• usage-template: stable profile identifier: genesis/error-v0.2 → Identifier

Sources

• crates/gc_kernel/src/error.rs: pub enum KernelErrorKind, BadForm, StepLimit, MemoryLimit
• crates/gc_cli_driver/src/diagnostics.rs: DIAGNOSTICS_SCHEMA_V1, embedded_diagnostic_catalog, primary_span, safe_repair_actions
• docs/spec/GC_DIAGNOSTIC_CATALOG_v0.1.schema.json: catalogIdentitySha256, diagnosticCount, safeRepairActions
• docs/spec/CLI_JSON_SCHEMAS_v0.1.md: Failure diagnostics, Unknown emitted codes, separate, explicit policy
• docs/spec/SEALS_DISPATCH_REPLAY.md: UNHANDLED/EFFECT/ERROR must be created by sealing
• genesis.version-surfaces.json: release_train, canonical-hash-profile, effect-log
• genesis.compatibility.json: reserved-not-stable, genesis/compat/v1/language-profile, genesis/compat/v1/bytecode

genesis/hash-profile/gcv0.2-blake3

core

Signature: stable profile identifier: genesis/hash-profile/gcv0.2-blake3

Domains: compatibility-identifiers
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: compatibility/unsupported-version

Contracts and examples

Contracts

• GC-AGENT-v0.3 names a training surface over the current v0.2 runtime identities; it does not rename serialized formats.
• All genesis/compat/v1 IDs remain permanently reserved but not stable until R9 freeze requirements pass.
• Unknown future discriminators fail closed and every accepted predecessor has a migration record.

Examples

• usage-template: stable profile identifier: genesis/hash-profile/gcv0.2-blake3 → Identifier

Sources

• genesis.version-surfaces.json: release_train, canonical-hash-profile, effect-log
• genesis.compatibility.json: reserved-not-stable, genesis/compat/v1/language-profile, genesis/compat/v1/bytecode

genesis/language-profile/v0.2

core

Signature: stable profile identifier: genesis/language-profile/v0.2

Domains: compatibility-identifiers
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: compatibility/unsupported-version

Contracts and examples

Contracts

• GC-AGENT-v0.3 names a training surface over the current v0.2 runtime identities; it does not rename serialized formats.
• All genesis/compat/v1 IDs remain permanently reserved but not stable until R9 freeze requirements pass.
• Unknown future discriminators fail closed and every accepted predecessor has a migration record.

Examples

• usage-template: stable profile identifier: genesis/language-profile/v0.2 → Identifier

Sources

• genesis.version-surfaces.json: release_train, canonical-hash-profile, effect-log
• genesis.compatibility.json: reserved-not-stable, genesis/compat/v1/language-profile, genesis/compat/v1/bytecode

genesis/value-effect-hash/v0.2

core

Signature: stable profile identifier: genesis/value-effect-hash/v0.2

Domains: compatibility-identifiers
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: compatibility/unsupported-version

Contracts and examples

Contracts

• GC-AGENT-v0.3 names a training surface over the current v0.2 runtime identities; it does not rename serialized formats.
• All genesis/compat/v1 IDs remain permanently reserved but not stable until R9 freeze requirements pass.
• Unknown future discriminators fail closed and every accepted predecessor has a migration record.

Examples

• usage-template: stable profile identifier: genesis/value-effect-hash/v0.2 → Identifier

Sources

• genesis.version-surfaces.json: release_train, canonical-hash-profile, effect-log
• genesis.compatibility.json: reserved-not-stable, genesis/compat/v1/language-profile, genesis/compat/v1/bytecode

gfx

core

Signature: reviewed manifest/policy field: gfx

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• usage-template: reviewed manifest/policy field: gfx → ConfiguredValue

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced

gpk-v2

core

Signature: stable profile identifier: gpk-v2

Domains: compatibility-identifiers
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: compatibility/unsupported-version

Contracts and examples

Contracts

• GC-AGENT-v0.3 names a training surface over the current v0.2 runtime identities; it does not rename serialized formats.
• All genesis/compat/v1 IDs remain permanently reserved but not stable until R9 freeze requirements pass.
• Unknown future discriminators fail closed and every accepted predecessor has a migration record.

Examples

• usage-template: stable profile identifier: gpk-v2 → Identifier

Sources

• genesis.version-surfaces.json: release_train, canonical-hash-profile, effect-log
• genesis.compatibility.json: reserved-not-stable, genesis/compat/v1/language-profile, genesis/compat/v1/bytecode

if

core

Signature: (if condition then else) -> Value; exactly one branch is evaluated

Domains: evaluation
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound, NotCallable, StepLimit, MemoryLimit

Contracts and examples

Contracts

• Evaluation is pure and deterministic inside the kernel.
• def is valid only at module top level; fn and application accept source-level n-ary sugar but evaluate as curried application.
• if, begin, let, and the final closure application are tail-position aware.
• Map keys are data and map values are evaluated expressions.

Examples

• usage-template: (if condition then else) -> Value; exactly one branch is evaluated → Value; exactly one branch is evaluated

Sources

• crates/gc_kernel/src/eval_treewalk.rs: Special forms keyed by head symbol, “quote” =>, “fn” =>, “if” =>, “begin” =>, “let” =>, “prim” =>, “seal” =>, “unseal” =>
• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, parse_def, Desugar multi-arg lambda into nested unary closures

int/add

core

Signature: (prim int/add arg1:Int arg2:Int) -> Int

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• eval-arithmetic: (prim int/add 20 22) → 42

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

int/div

core

Signature: (prim int/div arg1:Int arg2:Int) -> Int

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• eval-euclidean-division: (prim int/div -7 3) → -3

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

int/eq?

core

Signature: (prim int/eq? arg1:Int arg2:Int) -> Bool

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim int/eq? arg1:Int arg2:Int) -> Bool → Bool

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

int/lt?

core

Signature: (prim int/lt? arg1:Int arg2:Int) -> Bool

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim int/lt? arg1:Int arg2:Int) -> Bool → Bool

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

int/mod

core

Signature: (prim int/mod arg1:Int arg2:Int) -> Int

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• eval-zero-divisor-sealed-error: (prim int/mod 7 0) → Sealed

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

int/mul

core

Signature: (prim int/mul arg1:Int arg2:Int) -> Int

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• eval-lexical-closure: (let ((x 2)) ((fn (y) (prim int/mul x y)) 3)) → 6

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

int/sub

core

Signature: (prim int/sub arg1:Int arg2:Int) -> Int

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim int/sub arg1:Int arg2:Int) -> Int → Int

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

int/to-str

core

Signature: (prim int/to-str arg1:Int) -> Str

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim int/to-str arg1:Int) -> Str → Str

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

integer

core

Signature: reader-form integer -> CoreForm

Domains: lexical-grammar
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm

Contracts and examples

Contracts

• Whitespace is space, tab, LF, or CR; semicolon comments end at LF.
• Integers are base-10 with an optional leading minus and arbitrary source precision.
• Strings and bytes support backslash, quote, n, r, t, xNN, and uNNNN escapes.
• A leading quote desugars exactly to (quote datum); colon-prefixed keywords remain symbols.

Examples

• usage-template: reader-form integer -> CoreForm → CoreForm

Sources

• crates/gc_coreform/src/parse.rs: enum Tok, comment: ‘;’ to end of line, bytes literal: b”…“, Tok::Quote

let

core

Signature: (let ((name expression)...) body...) -> Value

Domains: evaluation
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound, NotCallable, StepLimit, MemoryLimit

Contracts and examples

Contracts

• Evaluation is pure and deterministic inside the kernel.
• def is valid only at module top level; fn and application accept source-level n-ary sugar but evaluate as curried application.
• if, begin, let, and the final closure application are tail-position aware.
• Map keys are data and map values are evaluated expressions.

Examples

• eval-lexical-closure: (let ((x 2)) ((fn (y) (prim int/mul x y)) 3)) → 6

Sources

• crates/gc_kernel/src/eval_treewalk.rs: Special forms keyed by head symbol, “quote” =>, “fn” =>, “if” =>, “begin” =>, “let” =>, “prim” =>, “seal” =>, “unseal” =>
• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, parse_def, Desugar multi-arg lambda into nested unary closures

limits

core

Signature: reviewed manifest/policy field: limits

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• package-schema-1: schema = 1 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] [limits] step_limit = 1000 allow_unlimited = false → accept

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced

list

core

Signature: reader-form list -> CoreForm

Domains: lexical-grammar
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm

Contracts and examples

Contracts

• Whitespace is space, tab, LF, or CR; semicolon comments end at LF.
• Integers are base-10 with an optional leading minus and arbitrary source precision.
• Strings and bytes support backslash, quote, n, r, t, xNN, and uNNNN escapes.
• A leading quote desugars exactly to (quote datum); colon-prefixed keywords remain symbols.

Examples

• usage-template: reader-form list -> CoreForm → CoreForm

Sources

• crates/gc_coreform/src/parse.rs: enum Tok, comment: ‘;’ to end of line, bytes literal: b”…“, Tok::Quote

list/is-nil?

core

Signature: (prim list/is-nil? arg1:Data) -> Bool

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim list/is-nil? arg1:Data) -> Bool → Bool

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

map

core

Signature: reader-form map -> CoreForm

Domains: lexical-grammar
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm

Contracts and examples

Contracts

• Whitespace is space, tab, LF, or CR; semicolon comments end at LF.
• Integers are base-10 with an optional leading minus and arbitrary source precision.
• Strings and bytes support backslash, quote, n, r, t, xNN, and uNNNN escapes.
• A leading quote desugars exactly to (quote datum); colon-prefixed keywords remain symbols.

Examples

• usage-template: reader-form map -> CoreForm → CoreForm

Sources

• crates/gc_coreform/src/parse.rs: enum Tok, comment: ‘;’ to end of line, bytes literal: b”…“, Tok::Quote

map/entries

core

Signature: (prim map/entries arg1:Map) -> Vector<[Data Data]>

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim map/entries arg1:Map) -> Vector<[Data Data]> → Vector<[Data Data]>

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

map/from-entries

core

Signature: (prim map/from-entries arg1:Vector<[Data Data]>) -> Map

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim map/from-entries arg1:Vector<[Data Data]>) -> Map → Map

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

map/get

core

Signature: (prim map/get arg1:Map arg2:Data) -> Value|Nil

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim map/get arg1:Map arg2:Data) -> Value|Nil → Value|Nil

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

map/len

core

Signature: (prim map/len arg1:Map) -> Int

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim map/len arg1:Map) -> Int → Int

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

map/merge

core

Signature: (prim map/merge arg1:Map arg2:Map) -> Map

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim map/merge arg1:Map arg2:Map) -> Map → Map

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

map/put

core

Signature: (prim map/put arg1:Map arg2:Data arg3:Value) -> Map

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim map/put arg1:Map arg2:Data arg3:Value) -> Map → Map

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

max_alloc_units

core

Signature: reviewed manifest/policy field: max_alloc_units

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_alloc_units → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_bytes_len

core

Signature: reviewed manifest/policy field: max_bytes_len

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_bytes_len → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_effect_entries_per_test

core

Signature: reviewed manifest/policy field: max_effect_entries_per_test

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_effect_entries_per_test → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_effect_log_bytes_per_test

core

Signature: reviewed manifest/policy field: max_effect_log_bytes_per_test

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_effect_log_bytes_per_test → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_effect_ops

core

Signature: reviewed manifest/policy field: max_effect_ops

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_effect_ops → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_live_units

core

Signature: reviewed manifest/policy field: max_live_units

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_live_units → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_map_len

core

Signature: reviewed manifest/policy field: max_map_len

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_map_len → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_pair_cells

core

Signature: reviewed manifest/policy field: max_pair_cells

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_pair_cells → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_payload_bytes_per_op

core

Signature: reviewed manifest/policy field: max_payload_bytes_per_op

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_payload_bytes_per_op → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_payload_bytes_per_run

core

Signature: reviewed manifest/policy field: max_payload_bytes_per_run

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_payload_bytes_per_run → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_response_bytes_per_op

core

Signature: reviewed manifest/policy field: max_response_bytes_per_op

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_response_bytes_per_op → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_response_bytes_per_run

core

Signature: reviewed manifest/policy field: max_response_bytes_per_run

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_response_bytes_per_run → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_steps_per_test

core

Signature: reviewed manifest/policy field: max_steps_per_test

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_steps_per_test → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_string_len

core

Signature: reviewed manifest/policy field: max_string_len

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_string_len → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

max_vec_len

core

Signature: reviewed manifest/policy field: max_vec_len

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• usage-template: reviewed manifest/policy field: max_vec_len → ConfiguredValue

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

module-path::name

core

Signature: module declaration or metadata key: module-path::name

Domains: modules
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound

Contracts and examples

Contracts

• A module is an ordered sequence of CoreForm forms with top-level def bindings.
• Exported symbols use module-path::name and package metadata declares :caps, :exports, and :types.
• Canonical module hashing is independent of absolute filesystem paths.

Examples

• usage-template: module declaration or metadata key: module-path::name → ModuleMetadata|Binding

Sources

• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, fn parse_def
• docs/spec/MODULE_SCOPE.md: A module is a vector/list of CoreForm terms evaluated left-to-right., def` is only recognized at the top level

modules

core

Signature: reviewed manifest/policy field: modules

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• package-schema-1: schema = 1 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] [limits] step_limit = 1000 allow_unlimited = false → accept
• package-future-schema: schema = 2 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] → reject
• package-path-escape: schema = 1 name = "agent-profile" version = "0.0.0" dependencies = [] obligations = [] [[modules]] path = "../escape.gc" → reject

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced

name

core

Signature: reviewed manifest/policy field: name

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• package-schema-1: schema = 1 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] [limits] step_limit = 1000 allow_unlimited = false → accept
• package-future-schema: schema = 2 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] → reject
• package-path-escape: schema = 1 name = "agent-profile" version = "0.0.0" dependencies = [] obligations = [] [[modules]] path = "../escape.gc" → reject

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced

nil

core

Signature: reader-form nil -> CoreForm

Domains: lexical-grammar
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm

Contracts and examples

Contracts

• Whitespace is space, tab, LF, or CR; semicolon comments end at LF.
• Integers are base-10 with an optional leading minus and arbitrary source precision.
• Strings and bytes support backslash, quote, n, r, t, xNN, and uNNNN escapes.
• A leading quote desugars exactly to (quote datum); colon-prefixed keywords remain symbols.

Examples

• lexical-atoms: nil true false 0 -1 "x\n" b"\x41" symbol :keyword → accept
• allocation-unit-limit: nil → MemoryLimit
• live-unit-limit: nil → MemoryLimit

Sources

• crates/gc_coreform/src/parse.rs: enum Tok, comment: ‘;’ to end of line, bytes literal: b”…“, Tok::Quote

obligations

core

Signature: reviewed manifest/policy field: obligations

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• package-schema-1: schema = 1 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] [limits] step_limit = 1000 allow_unlimited = false → accept
• package-future-schema: schema = 2 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] → reject
• package-path-escape: schema = 1 name = "agent-profile" version = "0.0.0" dependencies = [] obligations = [] [[modules]] path = "../escape.gc" → reject

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced

package-schema-1

core

Signature: stable profile identifier: package-schema-1

Domains: compatibility-identifiers
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: compatibility/unsupported-version

Contracts and examples

Contracts

• GC-AGENT-v0.3 names a training surface over the current v0.2 runtime identities; it does not rename serialized formats.
• All genesis/compat/v1 IDs remain permanently reserved but not stable until R9 freeze requirements pass.
• Unknown future discriminators fail closed and every accepted predecessor has a migration record.

Examples

• usage-template: stable profile identifier: package-schema-1 → Identifier

Sources

• genesis.version-surfaces.json: release_train, canonical-hash-profile, effect-log
• genesis.compatibility.json: reserved-not-stable, genesis/compat/v1/language-profile, genesis/compat/v1/bytecode

pair/as-proper-list

core

Signature: (prim pair/as-proper-list arg1:Pair|Nil) -> Vector<Data>|Nil

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim pair/as-proper-list arg1:Pair|Nil) -> Vector<Data>|Nil → Vector<Data>|Nil

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

pair/car

core

Signature: (prim pair/car arg1:Pair) -> Data

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim pair/car arg1:Pair) -> Data → Data

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

pair/cdr

core

Signature: (prim pair/cdr arg1:Pair) -> Data

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim pair/cdr arg1:Pair) -> Data → Data

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

pair/cons

core

Signature: (prim pair/cons arg1:Data arg2:Data) -> Pair

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim pair/cons arg1:Data arg2:Data) -> Pair → Pair

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

prim

core

Signature: (prim primitive-name argument...) -> Value

Domains: evaluation
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound, NotCallable, StepLimit, MemoryLimit

Contracts and examples

Contracts

• Evaluation is pure and deterministic inside the kernel.
• def is valid only at module top level; fn and application accept source-level n-ary sugar but evaluate as curried application.
• if, begin, let, and the final closure application are tail-position aware.
• Map keys are data and map values are evaluated expressions.

Examples

• eval-arithmetic: (prim int/add 20 22) → 42
• eval-euclidean-division: (prim int/div -7 3) → -3
• eval-zero-divisor-sealed-error: (prim int/mod 7 0) → Sealed
• eval-lexical-closure: (let ((x 2)) ((fn (y) (prim int/mul x y)) 3)) → 6

Sources

• crates/gc_kernel/src/eval_treewalk.rs: Special forms keyed by head symbol, “quote” =>, “fn” =>, “if” =>, “begin” =>, “let” =>, “prim” =>, “seal” =>, “unseal” =>
• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, parse_def, Desugar multi-arg lambda into nested unary closures

property

core

Signature: reviewed manifest/policy field: property

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• usage-template: reviewed manifest/policy field: property → ConfiguredValue

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced

property_tests

core

Signature: reviewed manifest/policy field: property_tests

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• usage-template: reviewed manifest/policy field: property_tests → ConfiguredValue

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced

quote

core

Signature: (quote datum) -> Data; datum is not evaluated

Domains: lexical-grammar, evaluation
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound, NotCallable, StepLimit, MemoryLimit

Contracts and examples

Contracts

• Whitespace is space, tab, LF, or CR; semicolon comments end at LF.
• Integers are base-10 with an optional leading minus and arbitrary source precision.
• Strings and bytes support backslash, quote, n, r, t, xNN, and uNNNN escapes.
• A leading quote desugars exactly to (quote datum); colon-prefixed keywords remain symbols.
• Evaluation is pure and deterministic inside the kernel.
• def is valid only at module top level; fn and application accept source-level n-ary sugar but evaluate as curried application.
• if, begin, let, and the final closure application are tail-position aware.
• Map keys are data and map values are evaluated expressions.

Examples

• usage-template: (quote datum) -> Data; datum is not evaluated → Data; datum is not evaluated

Sources

• crates/gc_coreform/src/parse.rs: enum Tok, comment: ‘;’ to end of line, bytes literal: b”…“, Tok::Quote
• crates/gc_kernel/src/eval_treewalk.rs: Special forms keyed by head symbol, “quote” =>, “fn” =>, “if” =>, “begin” =>, “let” =>, “prim” =>, “seal” =>, “unseal” =>
• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, parse_def, Desugar multi-arg lambda into nested unary closures

replay

profile-selected

Signature: stable profile identifier: replay

Domains: effects
Effects: consumes recorded effects without external I/O
Capabilities: none
Diagnostics: EFFECT, ERROR, replay/mismatch, caps/denied

Contracts and examples

Contracts

• Effects are explicit Pure or Perform programs; kernel evaluation performs no host operation.
• The host runner denies every operation absent from caps.toml and records deterministic replay facts.
• Replay consumes entries in order and rejects operation, hash, decision, capability, or scheduler mismatch.

Examples

• usage-template: stable profile identifier: replay → Identifier

Sources

• crates/gc_prelude/src/prelude.rs: core/effect::pure, core/effect::perform, core/effect::bind
• docs/spec/SEALS_DISPATCH_REPLAY.md: Runner is deny-by-default, Every performed effect appends a deterministic log entry

reserved-not-stable

core

Signature: stable profile identifier: reserved-not-stable

Domains: compatibility-identifiers
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: compatibility/unsupported-version

Contracts and examples

Contracts

• GC-AGENT-v0.3 names a training surface over the current v0.2 runtime identities; it does not rename serialized formats.
• All genesis/compat/v1 IDs remain permanently reserved but not stable until R9 freeze requirements pass.
• Unknown future discriminators fail closed and every accepted predecessor has a migration record.

Examples

• usage-template: stable profile identifier: reserved-not-stable → Identifier

Sources

• genesis.version-surfaces.json: release_train, canonical-hash-profile, effect-log
• genesis.compatibility.json: reserved-not-stable, genesis/compat/v1/language-profile, genesis/compat/v1/bytecode

schema

core

Signature: reviewed manifest/policy field: schema

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• package-schema-1: schema = 1 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] [limits] step_limit = 1000 allow_unlimited = false → accept
• package-future-schema: schema = 2 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] → reject
• package-path-escape: schema = 1 name = "agent-profile" version = "0.0.0" dependencies = [] obligations = [] [[modules]] path = "../escape.gc" → reject

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced

seal

core

Signature: (seal token value) -> Sealed

Domains: evaluation
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound, NotCallable, StepLimit, MemoryLimit

Contracts and examples

Contracts

• Evaluation is pure and deterministic inside the kernel.
• def is valid only at module top level; fn and application accept source-level n-ary sugar but evaluate as curried application.
• if, begin, let, and the final closure application are tail-position aware.
• Map keys are data and map values are evaluated expressions.

Examples

• usage-template: (seal token value) -> Sealed → Sealed

Sources

• crates/gc_kernel/src/eval_treewalk.rs: Special forms keyed by head symbol, “quote” =>, “fn” =>, “if” =>, “begin” =>, “let” =>, “prim” =>, “seal” =>, “unseal” =>
• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, parse_def, Desugar multi-arg lambda into nested unary closures

step_limit

core

Signature: reviewed manifest/policy field: step_limit

Domains: resource-limits
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: StepLimit, MemoryLimit, ERROR

Contracts and examples

Contracts

• The default kernel step limit is 50000000; package limits may only tighten effective limits unless allow_unlimited is explicitly true.
• Kernel memory limits are deterministic semantic counters rather than host RSS estimates; allocation/live units follow the normative value-graph schedule.
• Effect runtime policy independently bounds operation count and per-op/per-run payload and response bytes.

Examples

• package-schema-1: schema = 1 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] [limits] step_limit = 1000 allow_unlimited = false → accept

Sources

• crates/gc_kernel/src/eval.rs: DEFAULT_STEP_LIMIT, pub struct MemLimits, max_alloc_units, max_live_units, max_pair_cells, max_string_len
• crates/gc_pkg/src/manifest.rs: pub struct Limits, pub struct Budgets, allow_unlimited
• crates/gc_effects/src/policy.rs: pub struct RuntimePolicy, max_effect_ops, max_response_bytes_per_run

str/concat

core

Signature: (prim str/concat arg1:Str arg2:Str) -> Str

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim str/concat arg1:Str arg2:Str) -> Str → Str

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

str/grapheme-len

core

Signature: (prim str/grapheme-len arg1:Str) -> Int

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim str/grapheme-len arg1:Str) -> Int → Int

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

str/grapheme-slice

core

Signature: (prim str/grapheme-slice arg1:Str arg2:Int arg3:Int) -> Str

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim str/grapheme-slice arg1:Str arg2:Int arg3:Int) -> Str → Str

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

str/join

core

Signature: (prim str/join arg1:Str arg2:Vector<Str>) -> Str

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim str/join arg1:Str arg2:Vector<Str>) -> Str → Str

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

str/len

core

Signature: (prim str/len arg1:Str) -> Int

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim str/len arg1:Str) -> Int → Int

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

str/nfc

core

Signature: (prim str/nfc arg1:Str) -> Str

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim str/nfc arg1:Str) -> Str → Str

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

str/repeat

core

Signature: (prim str/repeat arg1:Str arg2:Int) -> Str

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim str/repeat arg1:Str arg2:Int) -> Str → Str

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

str/scalar-len

core

Signature: (prim str/scalar-len arg1:Str) -> Int

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim str/scalar-len arg1:Str) -> Int → Int

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

str/to-bytes-utf8

core

Signature: (prim str/to-bytes-utf8 arg1:Str) -> Bytes

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim str/to-bytes-utf8 arg1:Str) -> Bytes → Bytes

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

string

core

Signature: reader-form string -> CoreForm

Domains: lexical-grammar
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm

Contracts and examples

Contracts

• Whitespace is space, tab, LF, or CR; semicolon comments end at LF.
• Integers are base-10 with an optional leading minus and arbitrary source precision.
• Strings and bytes support backslash, quote, n, r, t, xNN, and uNNNN escapes.
• A leading quote desugars exactly to (quote datum); colon-prefixed keywords remain symbols.

Examples

• usage-template: reader-form string -> CoreForm → CoreForm

Sources

• crates/gc_coreform/src/parse.rs: enum Tok, comment: ‘;’ to end of line, bytes literal: b”…“, Tok::Quote

sym/eq?

core

Signature: (prim sym/eq? arg1:Symbol arg2:Symbol) -> Bool

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim sym/eq? arg1:Symbol arg2:Symbol) -> Bool → Bool

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

sym/from-str

core

Signature: (prim sym/from-str arg1:Str) -> Symbol

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim sym/from-str arg1:Str) -> Symbol → Symbol

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

sym/to-str

core

Signature: (prim sym/to-str arg1:Symbol) -> Str

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim sym/to-str arg1:Symbol) -> Str → Str

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

symbol

core

Signature: reader-form symbol -> CoreForm

Domains: lexical-grammar
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm

Contracts and examples

Contracts

• Whitespace is space, tab, LF, or CR; semicolon comments end at LF.
• Integers are base-10 with an optional leading minus and arbitrary source precision.
• Strings and bytes support backslash, quote, n, r, t, xNN, and uNNNN escapes.
• A leading quote desugars exactly to (quote datum); colon-prefixed keywords remain symbols.

Examples

• lexical-atoms: nil true false 0 -1 "x\n" b"\x41" symbol :keyword → accept

Sources

• crates/gc_coreform/src/parse.rs: enum Tok, comment: ‘;’ to end of line, bytes literal: b”…“, Tok::Quote

tests

core

Signature: reviewed manifest/policy field: tests

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• usage-template: reviewed manifest/policy field: tests → ConfiguredValue

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced

true

core

Signature: reader-form true -> CoreForm

Domains: lexical-grammar
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm

Contracts and examples

Contracts

• Whitespace is space, tab, LF, or CR; semicolon comments end at LF.
• Integers are base-10 with an optional leading minus and arbitrary source precision.
• Strings and bytes support backslash, quote, n, r, t, xNN, and uNNNN escapes.
• A leading quote desugars exactly to (quote datum); colon-prefixed keywords remain symbols.

Examples

• lexical-atoms: nil true false 0 -1 "x\n" b"\x41" symbol :keyword → accept

Sources

• crates/gc_coreform/src/parse.rs: enum Tok, comment: ‘;’ to end of line, bytes literal: b”…“, Tok::Quote

unseal

core

Signature: (unseal token sealed-value) -> Value|Nil

Domains: evaluation
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Unbound, NotCallable, StepLimit, MemoryLimit

Contracts and examples

Contracts

• Evaluation is pure and deterministic inside the kernel.
• def is valid only at module top level; fn and application accept source-level n-ary sugar but evaluate as curried application.
• if, begin, let, and the final closure application are tail-position aware.
• Map keys are data and map values are evaluated expressions.

Examples

• usage-template: (unseal token sealed-value) -> Value|Nil → Value|Nil

Sources

• crates/gc_kernel/src/eval_treewalk.rs: Special forms keyed by head symbol, “quote” =>, “fn” =>, “if” =>, “begin” =>, “let” =>, “prim” =>, “seal” =>, “unseal” =>
• crates/gc_kernel/src/eval_forms.rs: pub(super) fn eval_module, parse_def, Desugar multi-arg lambda into nested unary closures

utf8/encode-codepoint

core

Signature: (prim utf8/encode-codepoint arg1:Int) -> Bytes

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim utf8/encode-codepoint arg1:Int) -> Bytes → Bytes

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

vec/get

core

Signature: (prim vec/get arg1:Vector arg2:Int) -> Value|Nil

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim vec/get arg1:Vector arg2:Int) -> Value|Nil → Value|Nil

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

vec/len

core

Signature: (prim vec/len arg1:Vector) -> Int

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim vec/len arg1:Vector) -> Int → Int

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

vec/push

core

Signature: (prim vec/push arg1:Vector arg2:Value) -> Vector

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim vec/push arg1:Vector arg2:Value) -> Vector → Vector

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

vec/set

core

Signature: (prim vec/set arg1:Vector arg2:Int arg3:Value) -> Vector

Domains: values
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm, Type, MemoryLimit

Contracts and examples

Contracts

• User-visible immutable data is represented by canonical CoreForm or persistent vectors/maps.
• Closures, seals, native functions, contracts, and effect programs are opaque runtime values with stable hashing rules.
• Primitive names are an exact allowlist; an unknown primitive is an error.
• Int is signed arbitrary precision; int/div and int/mod use Euclidean division with 0 <= remainder < abs(divisor), and a zero divisor returns a trusted sealed core/numeric-error.
• Dec is an opaque canonical fixed-decimal value with a maximum scale of 4096; construction and arithmetic that exceed the bound return a trusted sealed core/numeric-error.
• Str identity is exact UTF-8: no implicit normalization or folding; str/len counts bytes; Unicode 17 scalar/grapheme APIs and str/nfc are explicit.
• Effect paths are Unicode 17 NFC, base-relative, slash-only, case-exact, locale-free, and lossless.

Examples

• usage-template: (prim vec/set arg1:Vector arg2:Int arg3:Value) -> Vector → Vector

Sources

• crates/gc_kernel/src/value.rs: pub enum Value, CompiledClosure, SealToken, EffectProgram, EffectRequest
• crates/gc_kernel/src/eval_prims.rs: “int/add”, “vec/get”, “map/put”, “crypto/blake3”
• crates/gc_kernel/src/eval_prims/int_div.rs: pub(super) fn prim_int_div_mod, pub(super) fn prim_int_div_mod_values, “int/div”, “int/mod”
• crates/gc_coreform/src/fixed_decimal.rs: pub const MAX_FIXED_DECIMAL_SCALE: u32 = 4096, pub fn from_unscaled, pub fn parse, pub fn mul
• docs/spec/NUMERIC_PROFILE_v0.1.json: genesis/numeric-profile-v0.1, euclidean, core/numeric-error, “maxScale”: 4096, No Core float
• docs/spec/TEXT_PATH_PROFILE_v0.1.json: genesis/text-path-profile-v0.1, “version”: “17.0.0”, exact-utf8-scalar-sequence-no-implicit-normalization, core/text-range-error, capability-base-relative-no-host-prefix

vector

core

Signature: reader-form vector -> CoreForm

Domains: lexical-grammar
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: BadForm

Contracts and examples

Contracts

• Whitespace is space, tab, LF, or CR; semicolon comments end at LF.
• Integers are base-10 with an optional leading minus and arbitrary source precision.
• Strings and bytes support backslash, quote, n, r, t, xNN, and uNNNN escapes.
• A leading quote desugars exactly to (quote datum); colon-prefixed keywords remain symbols.

Examples

• usage-template: reader-form vector -> CoreForm → CoreForm

Sources

• crates/gc_coreform/src/parse.rs: enum Tok, comment: ‘;’ to end of line, bytes literal: b”…“, Tok::Quote

version

core

Signature: reviewed manifest/policy field: version

Domains: packages
Effects: pure; no ambient host effect
Capabilities: none
Diagnostics: manifest/invalid, obligation/failed

Contracts and examples

Contracts

• Current writers emit package schema 1 and genesis.lock version 2; future versions fail closed.
• Module, dependency, and capability paths are relative, slash-separated, non-empty, and contain no dot or parent components.
• Module/dependency hashes and obligations are verified before package acceptance.

Examples

• package-schema-1: schema = 1 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] [limits] step_limit = 1000 allow_unlimited = false → accept
• package-future-schema: schema = 2 name = "agent-profile" version = "0.0.0" modules = [] dependencies = [] obligations = [] → reject
• package-path-escape: schema = 1 name = "agent-profile" version = "0.0.0" dependencies = [] obligations = [] [[modules]] path = "../escape.gc" → reject

Sources

• crates/gc_pkg/src/manifest.rs: PACKAGE_MANIFEST_SCHEMA_VERSION, pub struct PackageManifest, validate_manifest_paths
• docs/spec/PACKAGE_TOML.md: Required Keys, Package evaluation limits are enforced