Skip to content
Topaz6.0 · Before release
Download

Search documentation

Specification 6.0 · Not released · Tested product 5.21.3

Use arrow keys to choose a result. Press Enter to open.

Type an API name, diagnostic number, rule, or project topic.

    Library

    std.lispex.inspectConsumerArtifact

    Decode and validate a receipt artifact without evaluation or authentication.

    inspectConsumerArtifact(package: LispexPackage, bytes: Bytes, limits: LispexHostLimits) -> Result<LispexConsumerArtifactInspection, LispexEvidenceError>
    Receiver
    Not applicable
    Minimum arity
    3
    Maximum arity
    3

    Declaration and parameters

    Link

    Availability

    Included by default: no

    Import std.lispex from an application package with a verified lock. Packages with [lispex] require --locked. Application profile topaz/lispex-decision-application/1 uses evaluator profile lispex/r7rs-rule-embedded-core/1. Application profile topaz/lispex-decision-application/2 uses evaluator profile lispex/r7rs-rule-current-profile-bounded/1.

    The generated-module resolver gate starts at language mode 5.18. Compatibility of this API with earlier released editions remains Pending. Target deployment conditions are native (native-only), web (web-isolated-workers), web-worker (web-isolated-workers). Runtime payload follows checker-reached rules. An empty reached-rule set includes no runtime payload. Application quotas are required. Lock-only packages do not receive these application modules.

    Source evidence

    Receiver

    Not applicable

    Parameter constraints

    Additional contracts are Pending.

    inspectConsumerArtifact accepts an admitted package, complete artifact bytes and finite host limits. It decodes and validates the receipt and evidence bindings before returning an inspection.

    Inspection performs no guest evaluation or replay. Structural validity does not authenticate an issuer. authenticateEvidence applies explicit trust separately.

    std.lispex exports neither verifyConsumerArtifact nor consumerArtifactFromBytes. inspectConsumerArtifact is the single artifact byte admission operation.

    Related rule: Inspect and validate consumer artifacts in one call

    inspectConsumerArtifact accepts an admitted package, complete supplied bytes and finite host limits. Validate the limits before decoding. Parse one complete artifact under its declared supported 2.0 container and codec versions.

    Validate structure, integrity and supported semantic contracts. A portable receipt is required. Check that its complete request identity and canonical outcome agree with any included execution evidence and profile work binding. Reject trailing bytes, missing cores, inconsistent identities and unsupported versions.

    Return an inspection containing the admitted immutable artifact, its LispexReceipt and optional LispexExecutionEvidence. artifactBytes is the byte count of the entire accepted representation. portableCoreBytes is the byte count of its portable receipt representation.

    A missing execution evidence envelope is None. A validated signature envelope remains unauthenticated until authenticateEvidence accepts it under explicit trust. Structural inspection never sets an authenticated Boolean.

    Invalid structure, missing portable receipt or inconsistent binding returns InvalidConsumerArtifact. Unsupported contracts or components return Admission. Exhausted host work, allocation, frame or channel budgets return LimitExceeded. The first failed check is retained without exposing a partially accepted artifact.

    Inspection neither invokes the guest nor recreates a canonical outcome. It checks supplied records and cannot prove that a particular engine ran the program. Reproducing the recorded request is freshReplay and authenticating the issuer is authenticateEvidence.

    consumerArtifactBytes returns the exact immutable accepted or produced container. portableCoreBytes returns its portable receipt bytes. Both representations were established within the creating operation budget and are retained with the handle. Reading them performs no fresh encoding or I/O.

    The same supplied bytes, supported contract and finite limits produce the same structural inspection or deterministic refusal. Issuance and engine metadata can differ between containers while their portable receipt bytes remain equal.

    A 1.21 artifact remains a 1.21 record. Inspection does not relabel legacy hashes, settlements or receipt fields as 2.0 identities or outcomes.

    Related rule: Inspect portable receipt artifacts without evaluation

    Result

    Additional contracts are Pending.

    The declared result type is Result<LispexConsumerArtifactInspection, LispexEvidenceError>.

    Effects

    Pending

    Failures

    Pending

    Result and effects

    Link

    Decode and validate a receipt artifact without evaluation or authentication.

    Why

    Link

    The inspection contract gives this operation one explicit input boundary and preserves the distinct result and failure cases.

    Related entries

    Link

    std.lispex

    Inspect and validate consumer artifacts in one call

    Link
    Ruletopaz.stdlib.contract.consumer-artifact-inspect.rule

    Inspect and validate consumer artifacts in one call

    inspectConsumerArtifact accepts an admitted package, complete artifact bytes and finite host limits. It decodes and validates the receipt and evidence bindings before returning an inspection.

    Inspection performs no guest evaluation or replay. Structural validity does not authenticate an issuer. authenticateEvidence applies explicit trust separately.

    std.lispex exports neither verifyConsumerArtifact nor consumerArtifactFromBytes. inspectConsumerArtifact is the single artifact byte admission operation.

    Why

    The former verification and inspection names performed the same validation and expressed the same intention. Decoding bytes into an accepted artifact is part of that admission. Authenticating an issuer and reproducing a semantic request express different intentions.

    Examples Reject the removed verification name in a verified application

    Diagnostics TPZ3009

    Source evidence

    Reject the removed verification name in a verified application

    Link

    reject · checking · Verification: not-run

    main.tpzReject the removed verification name in a verified applicationOpen in Playground
    1. import std.lispex { verifyConsumerArtifact }
    3. export function main(args: Array<string>, stdin: string) -> Result<int, string> {
    4. return Ok(0)
    5. }
    Expected outputNonzero exit
    No stdout.
    $ topaz check main.tpz --locked --format json · target product 5.21.3
    Expected result

    Expected result

    Rejection during resolve. Nonzero exit.

    • TPZ3009 selected-name-not-exported at main.tpz:1:21

    No stdout.

    This exact example has not been executed.

    Check this source inside an existing verified Lispex application package supplied through TOPAZ_LISPEX_APPLICATION. The product test copies that package and adds this source file. This example does not create or prepare its package lock or binary artifacts.

    Source evidence

    Diagnostics

    Link

    Name is not exported

    Inspect portable receipt artifacts without evaluation

    Link
    Ruletopaz.stdlib.contract.lispex-inspection.rule

    Inspect portable receipt artifacts without evaluation

    inspectConsumerArtifact accepts an admitted package, complete supplied bytes and finite host limits. Validate the limits before decoding. Parse one complete artifact under its declared supported 2.0 container and codec versions.

    Validate structure, integrity and supported semantic contracts. A portable receipt is required. Check that its complete request identity and canonical outcome agree with any included execution evidence and profile work binding. Reject trailing bytes, missing cores, inconsistent identities and unsupported versions.

    Return an inspection containing the admitted immutable artifact, its LispexReceipt and optional LispexExecutionEvidence. artifactBytes is the byte count of the entire accepted representation. portableCoreBytes is the byte count of its portable receipt representation.

    A missing execution evidence envelope is None. A validated signature envelope remains unauthenticated until authenticateEvidence accepts it under explicit trust. Structural inspection never sets an authenticated Boolean.

    Invalid structure, missing portable receipt or inconsistent binding returns InvalidConsumerArtifact. Unsupported contracts or components return Admission. Exhausted host work, allocation, frame or channel budgets return LimitExceeded. The first failed check is retained without exposing a partially accepted artifact.

    Inspection neither invokes the guest nor recreates a canonical outcome. It checks supplied records and cannot prove that a particular engine ran the program. Reproducing the recorded request is freshReplay and authenticating the issuer is authenticateEvidence.

    consumerArtifactBytes returns the exact immutable accepted or produced container. portableCoreBytes returns its portable receipt bytes. Both representations were established within the creating operation budget and are retained with the handle. Reading them performs no fresh encoding or I/O.

    The same supplied bytes, supported contract and finite limits produce the same structural inspection or deterministic refusal. Issuance and engine metadata can differ between containers while their portable receipt bytes remain equal.

    A 1.21 artifact remains a 1.21 record. Inspection does not relabel legacy hashes, settlements or receipt fields as 2.0 identities or outcomes.

    Why

    Byte decoding and artifact validation express one admission intention, so inspectConsumerArtifact performs both. Whole artifact bytes and portable receipt bytes serve different interchange purposes. Structural inspection, issuer authentication and semantic replay preserve their separate meanings.

    Examples Validate artifact bytes and read the portable core

    Source evidence

    Validate artifact bytes and read the portable core

    Link

    check · checking · Verification: not-run

    main.tpzValidate artifact bytes and read the portable coreOpen in Playground
    1. import std.bytes { Bytes }
    2. import std.lispex {
    3. LispexPackage,
    4. LispexHostLimits,
    5. LispexConsumerArtifactInspection,
    6. LispexEvidenceError,
    7. inspectConsumerArtifact,
    8. consumerArtifactBytes,
    9. portableCoreBytes,
    10. }
    12. function core(package: LispexPackage, bytes: Bytes, host: LispexHostLimits) -> Result<Bytes, LispexEvidenceError> {
    13. let result: Result<LispexConsumerArtifactInspection, LispexEvidenceError> = inspectConsumerArtifact(package, bytes, host)
    14. let inspection: LispexConsumerArtifactInspection = result?
    15. let original: Bytes = consumerArtifactBytes(inspection.artifact)
    16. let count: int = inspection.artifactBytes
    17. let coreCount: int = inspection.portableCoreBytes
    18. return Ok(portableCoreBytes(inspection.artifact))
    19. }
    21. function failure(error: LispexEvidenceError) -> string {
    22. return match (error) {
    23. case InvalidConsumerArtifact(report) => report.code
    24. case Admission(report) => report.code
    25. case Authentication(report) => report.code
    26. case LimitExceeded(report) => report.code
    27. }
    28. }
    30. export function main(args: Array<string>, stdin: string) -> Result<int, string> {
    31. return Ok(0)
    32. }
    Expected outputexit 0
    No stdout.
    $ topaz check main.tpz --locked --format json · target product 5.21.3
    Expected result

    Expected result

    Checking accepts the program. Exit code 0.

    No stderr.

    No stdout.

    This exact example has not been executed.

    Use a verified Lispex application package supplied through TOPAZ_LISPEX_APPLICATION. This example specifies the Lispex 2.0 behavior. The product scope remains the public 5.21.3 observation scope.

    Source evidence

    Menu

    Download