std.lispex.rules

The Lispex 2.0 embedding contract governs both modules. Topaz is the host. Lispex is the guest. A guest invocation cannot invoke Topaz code or acquire host authority.

The host supplies a closed source bundle or an admitted prepared rule. Evaluation accepts one canonical Datum and returns one canonical Datum on success. Host closures and object references cannot cross the boundary.

Preparation and evaluation each receive a complete finite limit record. Missing fields, unknown fields, negative values and values outside the declared integer range are rejected before entry. No implicit default replaces an invalid record.

Guest code cannot obtain files, sockets, clocks, randomness, process state, environment variables or host callbacks. The host reads external facts before the call and passes their values explicitly.

The same canonical request under the same semantic and resource contracts produces the same canonical outcome. Host interruption and engine defects remain separate from deterministic language and resource failures.

Topaz decides what to do with a returned value after the guest invocation ends. A guest result does not itself grant permission to write files, send messages or perform another host action.

std.lispex.rules exports one factory for each rule binding declared by the admitted application lock. The spelling is the exact Topaz identifier in that row. The placeholder ruleName is descriptive and is not a literal universal export.

Reject missing, duplicate, invalid or colliding exported identifiers during package admission. Generated names do not depend on directory enumeration, source discovery, a network request or a mutable global registry.

Each factory accepts one complete LispexPreparationLimits record and returns Result of PreparedLispexRule or LispexPreparationError. Validate limits before preparing source or validating transported bytes. The factory has no zero argument or unlimited path.

The lock row fixes the source closure, selected entry, prepared artifact policy, evaluator and standard library identities, ABI, codec, language and Unicode contracts, profile and resource model. An installed mismatch refuses admission. Never silently replace a locked component.

A row containing closed source follows prepare. A row containing a transported prepared representation follows admitPrepared. Both paths must yield the same verified program and selected entry promised by the row and preserve the supplied preparation limits.

Repeated calls may share an immutable rule handle. Sharing and caching preserve the verified canonical program identity and evaluation charges. Preparation reuse may change preparation work and acceptance under its supplied budget. Each later evaluate call starts with its own explicit evaluation limits.

Factory failure preserves the same Source, Admission, Interrupted or EngineDefect case as the underlying operation. It creates no canonical evaluation outcome and no evaluation receipt. An unrelated unreached factory cannot alter a reached rule result.

A returned rule is evaluated through std.lispex.evaluate or evaluateWithEvidence. The factory does not evaluate a hidden input, return a business decision or grant a second host callback path.

A package example supplies a real verified lock through the product test fixture. Concrete generated names are package data. Their inventory is determined by that lock and is not an unresolved language behavior.