std.lispex

inspectConsumerArtifact accepts an admitted package, complete artifact bytes and finite host limits. It decodes and validates the receipt and evidence bindings before returning an inspection.

Inspection performs no guest evaluation or replay. Structural validity does not authenticate an issuer. authenticateEvidence applies explicit trust separately.

std.lispex exports neither verifyConsumerArtifact nor consumerArtifactFromBytes. inspectConsumerArtifact is the single artifact byte admission operation.

The Lispex 2.0 embedding contract governs both modules. Topaz is the host. Lispex is the guest. A guest invocation cannot invoke Topaz code or acquire host authority.

The host supplies a closed source bundle or an admitted prepared rule. Evaluation accepts one canonical Datum and returns one canonical Datum on success. Host closures and object references cannot cross the boundary.

Preparation and evaluation each receive a complete finite limit record. Missing fields, unknown fields, negative values and values outside the declared integer range are rejected before entry. No implicit default replaces an invalid record.

Guest code cannot obtain files, sockets, clocks, randomness, process state, environment variables or host callbacks. The host reads external facts before the call and passes their values explicitly.

The same canonical request under the same semantic and resource contracts produces the same canonical outcome. Host interruption and engine defects remain separate from deterministic language and resource failures.

Topaz decides what to do with a returned value after the guest invocation ends. A guest result does not itself grant permission to write files, send messages or perform another host action.

The following table defines the Topaz 6.0 exports. A removed name is absent from this edition. The product scope attached to examples remains the public 5.21.3 observation scope.

consumerArtifactFromBytes and inspectConsumerArtifact previously expressed the same intention of accepting artifact bytes as validated input. Inspection now performs decoding and validation once. The extra constructor name is absent.

verifyConsumerArtifact and inspectConsumerArtifact previously performed the same validation. The verification alias remains absent. Signature authentication and semantic replay have different intentions and retain separate operations.

The old operational quota alternatives mixed physical host admission with deterministic guest accounting. Their distinctions remain in the report code and resource axis. Moving them to the correct phase does not turn a refusal into a canonical failure.

The old identity and inspection fields mixed program meaning, artifact bytes and issuer trust. The replacement fields preserve those distinct intentions in separate typed records. No legacy digest is reinterpreted as a Lispex 2.0 identity.

The removed declarations retain resolved question records in the authoring source. Each record preserves its original question and links this migration contract. Retained targets keep their resolved records on their current pages.

LispexValue is an immutable validated Datum handle. Its codec identity travels with the value. Guest inputs and successful results use this same representation. Equality follows the selected canonical value contract.

valueFromCanonical accepts an admitted package, immutable bytes and complete finite host limits. Decode exactly one complete canonical Datum under the package codec. Reject malformed bytes, trailing values, unsupported versions and noncanonical representations as InvalidCanonicalValue.

valueFromDatum accepts a LispexDatumView and creates a detached immutable snapshot. Boolean accepts a bool. Number accepts exact BigInt numerator and denominator values and normalizes their rational value. A zero denominator returns InvalidDatum. No inexact floating value is accepted.

Character accepts exactly one Unicode scalar. Empty text, several scalars and invalid scalar representations return InvalidDatum. Symbol and Text preserve their scalar sequences without normalization or case conversion. Empty symbols follow the selected Datum codec contract.

EmptyList is the empty list value. Pair holds two validated values. Vector copies its Array of validated values in order. Bytevector retains exact immutable bytes. Every child must use the same admitted codec contract. A mismatched child returns InvalidDatum before guest entry.

The exposed view has no procedure, callback or host object alternative. A procedure cannot be hidden in Pair or Vector because each child must already be a validated LispexValue. Construction does not follow host reference graphs. Mutating a source Array after conversion cannot change the sealed value.

valueView returns a detached view of the same value. Number exposes the normalized exact numerator and positive denominator. Aggregate views contain sealed child handles. Changing a returned Array changes that view and does not mutate the LispexValue.

Conversions reserve their work, allocation, traversal frames, input and result channels under LispexHostLimits. Host conversion exhaustion returns LimitExceeded with the first axis. A failure returns no prefix or partly valid value. It creates no canonical evaluation outcome or receipt.

canonicalBytes returns the immutable canonical bytes established when the handle was created. It does not decode, evaluate, discover a codec or perform fresh serialization. The handle retains that bounded representation, so reading it starts no new guest or host work account.

Host conversion work is separate from evaluation work. Evaluation still charges canonical input decoding and canonical result or failure encoding under its own limits. Prevalidated bytes cannot bypass those charges.

The same value, codec and explicit conversion limits have the same accepted canonical bytes or deterministic conversion refusal. Exact codec bytes and normalization encodings belong to the admitted versioned Lispex contract. Legacy 1.21 bytes are never relabeled as 2.0 bytes.

LispexBoundaryReport identifies the phase, a stable code, named presentation fields and a human readable message. LispexReportField names and values explain the host failure. They are diagnostic presentation rather than canonical guest condition parameters.

source is Some of the exact source identity when that identity has been established and None otherwise. verified lists identities actually validated before refusal. It cannot contain a proposed program or request identity merely because the input claimed one.

A source reading or normalization failure before a canonical program exists uses a source bound report. It may identify a source location through named fields. It has no fabricated canonical program site or completed evaluation receipt.

Admission rejects unsupported contracts, missing components, identity mismatches, ambient imports and an insufficient physical execution envelope. Its report identifies the first failed check and relevant supplied component. A mismatch never selects a substitute component or smaller limits.

Host budget reports retain the submitted finite limits and first exhausted host axis in their fields. Host scheduling and physical failures describe an attempt rather than a deterministic guest resource result.

Messages, field presentation order, paths and local coordinates do not define canonical outcome identity. Programs branch on the phase and code under the selected report contract. Reading report fields performs no I/O or guest execution.

No report accessor raises a second Lispex failure. Array fields follow collection value semantics. Reading a report does not retry its failed operation, consume a guest budget or authorize an external action.

std.lispex is the Topaz 6.0 host module. Importing it does not start a guest or grant guest capabilities. std.lispex.rules additionally requires the verified application lock that determines its generated names.

LispexPackageInput contains the manifest, evaluator artifact, standard library artifact and every declared dependency as immutable bytes. Each LispexPackagePart pairs dependency bytes with an exact logical name declared by the manifest. Admission computes and verifies the identity promised for that name. Arrays and records at call entry follow collection value semantics.

admitPackage requires complete finite LispexHostLimits. Validate the limit record before parsing artifacts. Reject negative or unrepresentable fields without beginning admission. No package handle is returned on refusal.

Check manifest structure and declared identities before using a component. Verify evaluator interface and exports, standard library, ABI, codec, language semantics, Unicode semantics, selected profile and resource model. Every required component must be supplied exactly once and match its declared identity.

Dependencies resolve from the supplied package closure. Reject missing or duplicate components, identity collisions and incompatible contracts. Do not consult the working directory, environment, network, host registry or another installed evaluator as a substitute.

Evaluator artifacts must expose the selected data only interface. Reject host function imports and any dependency that obtains ambient authority. A callback advertised as pure is still a callback and is rejected. No import can turn a guest value into a host object reference.

The host checks the physical envelope needed to honor the selected semantic limits and supported package contracts. Refuse an unsupported target or insufficient envelope before guest entry. Do not silently lower limits or retry another engine.

Return Ok of an immutable LispexPackage after all checks succeed. The handle records the exact verified contract identities and closure. Refusal returns Err of LispexBoundaryReport. The checks may fail deterministically on supplied data or operationally on the physical host, but neither case is a canonical evaluation outcome.

applicationPackage reads an already admitted handle associated with the current verified application lock. It performs no parsing, preparation, guest execution or discovery. Without such a handle it returns a no-application-package report. Startup admission has its own recorded finite host limits.

The same package bytes, supported contract and finite budget produce the same validation decision unless the physical host cannot supply the declared envelope. Admission success alone proves neither issuer trust nor application permission to act.

The package container, ABI bytes and identity encodings remain Lispex versioned contracts. A supported admitted version is required. This API does not assign 1.21 artifact formats to Lispex 2.0.

LispexSource contains a logical bundle name and exact source bytes. LispexSourceBundle supplies entryModule, entryBinding and every source dependency. The input values accepted by prepare follow collection value semantics.

Logical source names are nonempty relative names with slash separators. Reject absolute names, empty segments, dot segments, backslashes and duplicates. Match names and bindings exactly without case folding or Unicode normalization. These names are bundle keys and never host filesystem paths.

entryModule selects one supplied source. entryBinding selects the resolved callable binding in that module under the admitted source contract. The entry must accept one input argument. A fixed unary procedure and a rest procedure that accepts one argument satisfy this requirement. This Topaz selection does not add a Lispex export grammar or a last-expression convention.

prepare accepts an admitted package, the complete source snapshot and LispexPreparationLimits. Validate every required finite limit before reading source. Strictly read source under the selected source contract, resolve imports from the bundle and admitted standard library, expand and normalize, then verify the selected entry.

Preparation consumes its own work, cumulative allocation, semantic frames, source input, prepared result and diagnostic channels. It never borrows evaluation or profile work limits. A source, normalization, entry or preparation resource failure returns LispexPreparationError.Source with a source bound report.

Missing dependencies and unsupported components return Admission. Host cancellation, deadline and physical safety interruption return Interrupted. An engine invariant failure returns EngineDefect. The original first failure remains visible and no failed preparation yields a PreparedLispexRule.

A successful PreparedLispexRule seals the verified program, selected entry, dependency identities, semantic contracts and prepared artifact. Reusing it starts each evaluation with a fresh evaluation budget and fresh guest state. Preparation performs no guest computation. Required guest and module initialization belongs to each evaluation.

admitPrepared accepts transported bytes, an admitted package and finite preparation limits. Validate the container, exact integrity, interface, code and dependency identities, supported contracts and declared resource envelope before returning the same rule type. Previously prepared bytes are untrusted at a new boundary.

Transport validation verifies program, artifact and dependency identities from supplied material. Source provenance is optional for a supported source free artifact. inspectRule reports source as None unless exact source bytes and their program binding are verified under the supported format. A claimed source digest or signature alone is not verified provenance.

preparedBytes returns the immutable representation already reserved within the preparation result channel. It performs no new serialization, preparation or guest evaluation. Its size cannot escape the limit used to obtain the rule.

A warm preparation cache may change preparation work and its acceptance under the supplied preparation budget. Reuse still validates the cached contract and complete supplied inputs. It never increases an evaluation budget or changes evaluation charges or outcomes.

A source bound preparation report has no canonical evaluation outcome or evaluation receipt. Preserve source bytes and preparation contract when reproducing preparation. Exact evaluation replay additionally needs the complete evaluation request.

inspectConsumerArtifact accepts an admitted package, complete supplied bytes and finite host limits. Validate the limits before decoding. Parse one complete artifact under its declared supported 2.0 container and codec versions.

Validate structure, integrity and supported semantic contracts. A portable receipt is required. Check that its complete request identity and canonical outcome agree with any included execution evidence and profile work binding. Reject trailing bytes, missing cores, inconsistent identities and unsupported versions.

Return an inspection containing the admitted immutable artifact, its LispexReceipt and optional LispexExecutionEvidence. artifactBytes is the byte count of the entire accepted representation. portableCoreBytes is the byte count of its portable receipt representation.

A missing execution evidence envelope is None. A validated signature envelope remains unauthenticated until authenticateEvidence accepts it under explicit trust. Structural inspection never sets an authenticated Boolean.

Invalid structure, missing portable receipt or inconsistent binding returns InvalidConsumerArtifact. Unsupported contracts or components return Admission. Exhausted host work, allocation, frame or channel budgets return LimitExceeded. The first failed check is retained without exposing a partially accepted artifact.

Inspection neither invokes the guest nor recreates a canonical outcome. It checks supplied records and cannot prove that a particular engine ran the program. Reproducing the recorded request is freshReplay and authenticating the issuer is authenticateEvidence.

consumerArtifactBytes returns the exact immutable accepted or produced container. portableCoreBytes returns its portable receipt bytes. Both representations were established within the creating operation budget and are retained with the handle. Reading them performs no fresh encoding or I/O.

The same supplied bytes, supported contract and finite limits produce the same structural inspection or deterministic refusal. Issuance and engine metadata can differ between containers while their portable receipt bytes remain equal.

A 1.21 artifact remains a 1.21 record. Inspection does not relabel legacy hashes, settlements or receipt fields as 2.0 identities or outcomes.

authenticateEvidence accepts an admitted LispexConsumerArtifact, explicit LispexTrustPolicy and complete finite host limits. The key, issuer and algorithm arrays follow collection value semantics at call entry, before verification.

Each LispexTrustKey contains its key identifier, issuer, algorithm and immutable public key bytes. The policy lists the issuers and algorithms it accepts. Duplicate identifiers, malformed keys, unsupported algorithms and contradictory policy rows return Authentication with a structured report.

A valid envelope must bind the artifact and its request, canonical outcome, execution evidence and declared profile work as required by its versioned signing contract. Use a matching caller supplied key whose issuer and algorithm the policy allows.

An unsigned artifact, an unknown issuer, an untrusted key, a disallowed algorithm or an invalid signature returns Authentication. A lack of trust is not a language failure. Unsupported envelope contracts return Admission. Host budget exhaustion returns LimitExceeded.

Return LispexAuthentication with the authenticated artifact identity, issuer, key identifier and algorithm. The value records this policy decision. It does not say that the guest program is correct or that the caller may perform an external action.

No implicit system trust store, network key lookup, revocation request or live clock participates. If an application needs time or revocation policy, it evaluates explicit captured facts in a separate host decision. The signature contract and supported cryptography remain versioned upstream choices.

Authentication performs no guest evaluation and does not change request identity, canonical outcome or replay eligibility. The same artifact, trust data, algorithm contract and limits produce the same authentication decision unless the physical host fails.

Inspection establishes a structurally valid record. Authentication establishes the selected issuer binding. Replay compares the actual canonical outcome of the same request. A successful result from one operation does not imply success from either of the others.

evaluate(rule, input, limits) returns Result<LispexEvaluation, LispexAttemptError>. It submits the immutable prepared program, one canonical input value, and the complete declared evaluation limits. It snapshots caller owned data before entry and performs no external action on behalf of the guest.

Ok contains a completed evaluation even when the rule fails. LispexEvaluation.request records the verified semantic request and its identity. LispexEvaluation.settlement records the completed canonical outcome of that request. The result carries no successful value when its settlement is a failure.

LispexSettlement.Complete(value) contains exactly one canonical LispexValue. A false Boolean or an application value named deny or review remains a successful language result. The adapter neither interprets that value as a host command nor performs an external action.

LispexSettlement.SemanticFailure(condition) records an uncaught deterministic language or domain failure. The condition retains its stable phase, stable code, typed canonical parameters, and canonical failure site. Returning a procedure or multiple values across the single Datum result boundary cannot produce Complete.

LispexSettlement.LimitExhaustion(condition) records a deterministic stop under the selected evaluation resource model and limits. Its condition identifies the first exhausted resource axis and canonical failure site. It preserves the first cause and returns no successful result prefix.

A LispexCondition identifies a failure through its phase and stable code together. Its parameters retain their canonical types and values. Its site follows the selected canonical site contract. A resource condition also carries the exhausted axis required by that contract.

Translated messages, source coordinates, host paths, and displayed stacks are diagnostic presentation. They do not replace condition parameters or alter the canonical settlement. A code or human message alone is insufficient to compare failures.

LispexAttemptError.Admission(report) reports a refused submission. The report records the submitted request data and identities verified before refusal. Admission refusal produces neither a canonical evaluation outcome nor an evaluation receipt.

LispexAttemptError.Interrupted(fault) reports a host interruption that prevented evaluation completion. Cancellation, a host deadline, or loss of host resources cannot be relabeled as a deterministic Lispex limit stop. The attempt supplies no canonical evaluation outcome or evaluation receipt.

LispexAttemptError.EngineDefect(report) identifies an evaluator defect that prevented a conforming completed evaluation. It remains distinct from an admitted program's language failure. The attempt supplies no canonical evaluation outcome or evaluation receipt.

A boundary report states its stage and stable reason with named presentation fields. It cites only identities already verified at that stage. It does not synthesize a canonical input, program identity, evaluation request identity, or failure site that validation has not established.

A preparation read or normalization failure before canonical code exists produces a report bound to the exact submitted source. It stops before entry evaluation. Source locations in that report describe the supplied source and do not claim a canonical evaluation location.

Canonical input decoding and canonical result or failure encoding remain evaluation work. A deterministic resource stop during those evaluation events is LimitExhaustion. Whether the guest entry was called does not by itself determine the outcome class.

A lexical guest guard can recover from ordinary runtime and domain conditions under the Lispex condition contract. Preparation, admission, resource, operational, and internal failures remain outside guest recovery. Resource exhaustion runs no guest recovery or cleanup and preserves its first cause.

Every call starts a fresh evaluation account. Reusing a prepared rule preserves its program while supplying an independent input and declared budget. An earlier value, failure, or host cache state cannot become hidden input to a later evaluation.

A conforming execution of the same admitted semantic request produces the same Complete value or the same complete failure condition. The comparison includes the phase, code, typed parameters, canonical site, and resource axis when present. It excludes host execution observations.

Deterministic language failures and evaluation resource stops remain eligible for portable receipts and exact replay. An outer attempt error does not become a receipt eligible settlement merely because its report is structured or reproducible.

SemanticFailure carries resource as None(). LimitExhaustion carries Some of the first exhausted axis. Channel names identify the input, result or diagnostics channel declared by the selected versioned model. They are not locale dependent messages.

Each evaluation performs the required guest and module initialization under its evaluation budget before the selected entry runs. A reused prepared handle contains no guest state from an earlier call. Preparation performs no guest computation.

Validate the evaluation limit record and supported contract before entry. A canonical input whose codec or contract differs from the prepared rule produces Admission. A valid handle does not permit a caller to reinterpret its bytes under another codec.

LispexIdentity is a typed immutable identity in a versioned domain. Its domain identifies the contract under which its value is interpreted. Equality compares the domain and the complete identity value under that contract. Matching display text from different domains does not establish identity equality.

Source identity identifies the exact submitted source bytes under the source contract. A source edit can change that identity while leaving canonical program identity unchanged. Source identity remains available for failures that occur before a canonical program exists.

Program identity identifies the canonical resolved program under its fixed dependencies. Canonicalization identifies one resolved form. It does not establish arbitrary program equivalence from equal values on one or more inputs.

Artifact identity identifies the exact bytes of an engine artifact under its artifact domain. It remains distinct from source and program identity. Two admitted engine artifacts can execute the same semantic request and produce the same canonical outcome.

LispexRequest.identity binds the complete evaluation request. That request fixes the canonical program, selected entry, input Datum, language and library semantics, Unicode semantics, resource model, and finite evaluation limits. Changing any semantic input creates a different request even when the result remains equal.

The request records effective limits after preset selection and before evaluation. Equal final values under different declared limits do not make the requests identical. A host cannot change the limits and preserve the original request identity.

Preparation and evaluation retain their own requests and budgets. Preparation reuse, a warm cache, and source presentation do not change the identity or charges of the admitted evaluation request. A preparation report does not stand in for an evaluation request.

Product, engine, platform, host paths, cache state, source layout, and display settings are outside the identity of an admitted semantic evaluation request. Their observations belong to source provenance or execution evidence as applicable.

Profile work identity binds the submitted request data, versioned profile work contract, and separate finite host budget. The profile work contract identifies the profile, schemas, required evidence, and host check rules. Changing that contract or host budget changes profile work identity without altering the base preparation or evaluation request.

Admission and later qualification or evidence reports retain the profile work identity of their submission. Each report cites only semantic identities already verified at its stage. An early refusal cannot manufacture a canonical input or program identity to complete its report.

Lispex 2.0 records use new identity domains. Historical Lispex 1.x records retain their original domains and meanings. Reading a historical record never promotes its identity or execution observations into Lispex 2.0 evidence.

Canonical Lispex value equality preserves exact mathematical numbers and raw Unicode scalar sequences. Aggregates compare their canonical kinds and ordered elements. Procedures, host references, physical storage identity, and floating point coercion do not participate in canonical value equality.

Canonical settlement equality compares the complete successful value or complete structured failure. It does not compare source formatting, diagnostic wording, engine selection, runtime counters, or evidence issuer. Identity equality and settlement equality answer different questions.

Inspection returns identity data already verified for the inspected object. Reading those fields performs no guest evaluation, fresh replay, network discovery, or authority acquisition. A caller supplied label cannot replace validation of an artifact or package identity.

Identity domain tags, digest algorithms, and serialized inputs follow their selected Lispex 2.0 contracts. The Topaz binding neither derives them from current Lispex 1.x encodings nor assigns hashes to contracts whose encoding remains unresolved.

LispexSemanticContract.standardLibrary names the selected library semantic contract. It is distinct from the standard library artifact bytes checked during package admission. The additional host profile selector belongs to LispexProfileRequest and profile work identity rather than the base semantic request.

LispexRuleIdentity.source is Some of the exact submitted source identity when source provenance was verified and None for a transported rule without verified source provenance. program identifies the canonical resolved code. artifact identifies the prepared artifact bytes returned by preparedBytes. contract names the verified semantic contracts. The evaluator artifact identity remains separate package and execution evidence.

LispexIdentity and LispexCanonicalSite are sealed values. Callers can compare them but cannot construct a verified identity or site from arbitrary text. Record inspections expose detached values and never change the sealed rule, request or artifact.

The opaque identity type exposes equality rather than a constructor from text. Each named field states its identity domain. A dependency submission uses a manifest name and raw bytes so admission can establish its identity without a caller forging a verified value.

freshReplay(rule, input, limits, artifact, hostLimits) returns Result<LispexEvaluation, LispexReplayError>. The prepared rule, canonical input, and complete evaluation limits supply the request to reproduce. The artifact supplies the retained portable receipt and any attached evidence. hostLimits bounds separate replay validation and comparison work.

Replay first verifies that the required canonical program, selected entry, input, fixed semantics, resource model, and finite limits are available and supported. It reconstructs the candidate request under the recorded identity contract. It compares that request with the recorded request before guest evaluation.

LispexReplayError.MissingRequest(report) identifies required request material that cannot be reconstructed or verified. No guest entry runs and no successful replay is reported. The adapter does not invent missing values, reuse current live facts, or substitute current defaults.

LispexReplayError.RequestMismatch(report) reports a difference between the candidate and recorded semantic requests. Changed canonical input, program, semantics, model, or declared limits cause mismatch even when the program would return the same value. No guest entry runs after that mismatch is established.

After the requests match and admission succeeds, replay performs a fresh evaluation with the supplied declared evaluation limits. It neither prepares a replacement program nor runs a modified request to obtain agreement. Prepared reuse and host cache state preserve the same normative evaluation events and charges.

Replay compares the complete canonical settlements. A successful value must match the recorded value. A semantic failure must match its phase, code, typed parameters, and canonical site. A resource stop must additionally match the exhausted axis.

Ok contains the fresh LispexEvaluation when the complete settlements agree. A reproduced SemanticFailure or LimitExhaustion is a successful replay comparison and remains that failure in the returned settlement. The adapter does not turn a reproduced failure into a Complete value.

LispexReplayError.OutcomeMismatch(report, evaluation) records a completed fresh evaluation whose canonical settlement differs from the retained settlement. The error retains the fresh evaluation as typed data and the report identifies its difference from the recorded binding. Equal diagnostic messages or equal final values from different failure paths cannot suppress this error.

LispexReplayError.AttemptFailed(error) preserves the admission, operational interruption, or engine defect returned by the fresh evaluation attempt. An incomplete attempt cannot be reported as either matching or different completed semantic outcomes.

LispexReplayError.HostWorkRefused(report, observation) reports a host budget refusal during replay validation or comparison. The report records the failed stage. observation is None before a completed fresh evaluation exists and Some of that evaluation after completion. It does not imply that semantic comparison completed and never becomes guest LimitExhaustion.

An admitted alternative engine artifact can replay the same semantic request. Engine bytes, source presentation, cache state, display locale, host paths, and execution timing do not enter canonical outcome comparison.

Replay consumes captured input values. A changed live clock, exchange rate, random source, or host environment cannot alter the retained input. A caller that captures a new value submits a different semantic request.

Replay does not authenticate an issuer, infer a trust policy, fetch keys, or authorize an external action. Attached evidence remains separately inspectable and authenticatable. Successful authentication does not bypass request reconstruction or settlement comparison.

The concrete replay report and receipt encodings follow the selected versioned contracts. Missing or unsupported contract versions produce explicit failure. A historical record is compared only under its original supported meaning and is never silently rewritten into a Lispex 2.0 request.