@lapxo/bound 0.1.9 → 0.2.1

package/dist/wasm/adapter.d.ts

@@ -0,0 +1,51 @@
+export interface WasmLimits {
+    readonly memoryBytes: number;
+    readonly stackBytes: number;
+    readonly executionMs: number;
+}
+export interface WasmTrust {
+    readonly runtime: string;
+    readonly wasm: string;
+    readonly modules: Readonly<Record<string, string>>;
+    readonly entry: string;
+    readonly aliases: Readonly<Record<string, string>>;
+    readonly limits: WasmLimits;
+    readonly byteLengths: {
+        readonly runtime: number;
+        readonly wasm: number;
+        readonly modules: Readonly<Record<string, number>>;
+    };
+}
+export interface WasmRequest {
+    readonly trusted: WasmTrust;
+    readonly assets: {
+        readonly runtime: Uint8Array | ArrayBuffer;
+        readonly wasm: Uint8Array | ArrayBuffer;
+    };
+    readonly modules: Readonly<Record<string, string>>;
+    readonly entry: string;
+    readonly aliases?: Readonly<Record<string, string>>;
+    readonly limits: WasmLimits;
+}
+export interface WasmResult {
+    readonly output: string;
+    readonly initializedMs: number;
+    readonly executionMs: number;
+}
+export interface WorkerPort {
+    postMessage(message: WasmRequest): void;
+    terminate(): unknown;
+    addEventListener?(type: string, listener: (event: {
+        data?: unknown;
+        message?: string;
+    }) => void): void;
+    on?(type: string, listener: (value: unknown) => void): void;
+}
+export declare function digest(bytes: Uint8Array): Promise<string>;
+export declare function preflight(request: WasmRequest): void;
+export declare function runWasmRequest(request: WasmRequest): Promise<WasmResult>;
+export declare function evaluateWasm(request: WasmRequest, { workerFactory, signal, lifetimeMs }: {
+    readonly workerFactory?: () => WorkerPort;
+    readonly signal?: AbortSignal;
+    readonly lifetimeMs: number;
+}): Promise<WasmResult>;

package/dist/wasm/adapter.js

@@ -0,0 +1,180 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+const owns = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
+const assetNames = ['runtime', 'wasm'], limitNames = ['memoryBytes', 'stackBytes', 'executionMs'];
+// Host adapter only. Source integrity grants neither admission nor authority.
+function refuse(cause) { throw Error('REFUSE·wasm ' + cause); }
+export async function digest(bytes) { return 'sha256:' + Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', bytes.slice().buffer))).map(x => x.toString(16).padStart(2, '0')).join(''); }
+async function verified(bytes, expected) { if (typeof SharedArrayBuffer !== 'undefined' && (bytes instanceof SharedArrayBuffer || (ArrayBuffer.isView(bytes) && bytes.buffer instanceof SharedArrayBuffer)))
+    refuse('shared assets unsupported'); const copy = (bytes instanceof Uint8Array ? new Uint8Array(bytes) : new Uint8Array(bytes)).slice(); if (!/^sha256:[a-f0-9]{64}$/.test(expected) || await digest(copy) !== expected)
+    refuse('integrity'); return copy; }
+const text = new TextEncoder();
+// Exact host-declared sizes bound copies, hashing and worker handoff before work.
+export function preflight(request) {
+    if (!request || Object.keys(request).some(k => !['trusted', 'assets', 'modules', 'aliases', 'entry', 'limits'].includes(k)))
+        refuse('request fields');
+    const { trusted, assets, modules, entry, aliases = {}, limits } = request, sizes = trusted?.byteLengths;
+    if (!sizes || !modules || !assets)
+        refuse('declared byte sizes');
+    if (Object.keys(assets).length !== 2 || Object.keys(assets).some(k => !['runtime', 'wasm'].includes(k)))
+        refuse('asset fields');
+    if (!limits || Object.keys(limits).length !== 3 || Object.keys(limits).some(k => !['memoryBytes', 'stackBytes', 'executionMs'].includes(k)))
+        refuse('limit fields');
+    for (const name of limitNames)
+        if (!Number.isSafeInteger(limits[name]) || limits[name] <= 0 || limits[name] !== trusted.limits?.[name])
+            refuse('limit ' + name);
+    if (typeof entry !== 'string' || entry !== trusted.entry || !aliases || Object.values(aliases).some(v => typeof v !== 'string') || JSON.stringify(Object.entries(aliases).sort()) !== JSON.stringify(Object.entries(trusted.aliases ?? {}).sort()))
+        refuse('entry or aliases differ from trusted context');
+    const names = Object.keys(modules), expected = Object.keys(trusted.modules ?? {});
+    if (names.length !== expected.length || names.some(n => !owns(trusted.modules, n)))
+        refuse('module count');
+    const size = (n, want) => { if (!Number.isSafeInteger(want) || want < 0)
+        refuse('declared size ' + n); return want; };
+    for (const name of assetNames) {
+        const v = assets[name];
+        if (typeof SharedArrayBuffer !== 'undefined' && (v instanceof SharedArrayBuffer || (ArrayBuffer.isView(v) && v.buffer instanceof SharedArrayBuffer)))
+            refuse('shared assets unsupported');
+        if (!(v instanceof Uint8Array || v instanceof ArrayBuffer) || v.byteLength !== size(name, sizes[name]))
+            refuse('asset bytes ' + name);
+    }
+    for (const name of names) {
+        const source = modules[name], want = size(name, sizes.modules?.[name]);
+        if (typeof source !== 'string' || source.length > want)
+            refuse('module bytes ' + name);
+        let bytes = 0;
+        for (let i = 0; i < source.length; i++) {
+            const c = source.charCodeAt(i);
+            bytes += c < 128 ? 1 : c < 2048 ? 2 : c >= 55296 && c <= 56319 && i + 1 < source.length && source.charCodeAt(i + 1) >= 56320 && source.charCodeAt(i + 1) <= 57343 ? (i++, 4) : 3;
+            if (bytes > want)
+                refuse('module bytes ' + name);
+        }
+        if (bytes !== want)
+            refuse('module bytes ' + name);
+    }
+}
+export async function runWasmRequest(request) {
+    preflight(request);
+    try {
+        request = structuredClone(request);
+    }
+    catch {
+        refuse('request is not cloneable');
+    }
+    const { trusted, assets, modules, aliases = {}, entry, limits } = request;
+    for (const name of limitNames)
+        if (!Number.isSafeInteger(limits?.[name]) || limits[name] <= 0 || limits[name] !== trusted?.limits?.[name])
+            refuse('limit ' + name);
+    if (entry !== trusted.entry || JSON.stringify(Object.entries(aliases).sort()) !== JSON.stringify(Object.entries(trusted.aliases ?? {}).sort()))
+        refuse('entry or aliases differ from trusted context');
+    const runtime = await verified(assets.runtime, trusted.runtime), wasm = await verified(assets.wasm, trusted.wasm), sources = {};
+    for (const [id, source] of Object.entries(modules)) {
+        if (!owns(trusted.modules, id))
+            refuse('undeclared module ' + id);
+        sources[id] = new TextDecoder('utf-8', { fatal: true }).decode(await verified(text.encode(source), trusted.modules[id]));
+    }
+    if (Object.keys(trusted.modules).some(id => !owns(sources, id)))
+        refuse('missing module');
+    if (!owns(sources, entry))
+        refuse('entry');
+    // The runtime is a closed esbuild ESM bundle: no imports and no second fetch.
+    const url = 'data:text/javascript;base64,' + bytesBase64(runtime), factory = await import(__rewriteRelativeImportExtension(url));
+    const started = performance.now(), quick = await factory.createQuickJS(wasm);
+    const rt = quick.newRuntime();
+    let context;
+    try {
+        context = rt.newContext();
+        const memory = rt.computeMemoryUsage();
+        let initializedMemory;
+        try {
+            initializedMemory = context.dump(memory);
+        }
+        finally {
+            memory.dispose();
+        }
+        const used = typeof initializedMemory === 'object' && initializedMemory !== null ? initializedMemory.memory_used_size : undefined;
+        if (typeof used !== 'number' || !Number.isSafeInteger(used) || used < 0)
+            refuse('initialized memory measurement unavailable');
+        if (used > limits.memoryBytes)
+            refuse('initialized memory ' + used + ' exceeds declared memory ' + limits.memoryBytes);
+        const initializedMs = performance.now() - started;
+        rt.setMemoryLimit(limits.memoryBytes);
+        rt.setMaxStackSize(limits.stackBytes);
+        const start = performance.now();
+        rt.setInterruptHandler(() => performance.now() - start > limits.executionMs);
+        rt.setModuleLoader(id => { if (!owns(sources, id))
+            refuse('undeclared import ' + id); return sources[id]; }, (parent, name) => { if (owns(aliases, name))
+            return aliases[name]; if (name.startsWith('.'))
+            return new URL(name, new URL(parent, 'file:///')).pathname; if (owns(sources, name))
+            return name; refuse('undeclared import ' + name); });
+        const result = context.evalCode(sources[entry], entry, { type: 'module' });
+        if (result.error) {
+            const e = context.dump(result.error);
+            result.error.dispose();
+            refuse('guest ' + JSON.stringify(e));
+        }
+        result.value.dispose();
+        const value = context.evalCode('globalThis.result');
+        if (value.error) {
+            const e = context.dump(value.error);
+            value.error.dispose();
+            refuse('result ' + JSON.stringify(e));
+        }
+        const output = context.dump(value.value);
+        value.value.dispose();
+        if (typeof output !== 'string')
+            refuse('result must be declared text');
+        return { output, initializedMs, executionMs: performance.now() - start };
+    }
+    finally {
+        context?.dispose();
+        rt.dispose();
+    }
+}
+function bytesBase64(bytes) { let binary = ''; for (const b of bytes)
+    binary += String.fromCharCode(b); return btoa(binary); }
+// A separate worker makes external abort possible while synchronous WASM executes.
+export async function evaluateWasm(request, { workerFactory = () => new Worker(new URL('./worker.js', import.meta.url), { type: 'module' }), signal, lifetimeMs }) {
+    if (!Number.isSafeInteger(lifetimeMs) || lifetimeMs <= 0)
+        refuse('worker lifetime');
+    if (signal?.aborted)
+        refuse('cancelled');
+    preflight(request);
+    return new Promise((resolve, reject) => { const worker = workerFactory(); let done = false; const finish = (error, value) => { if (done)
+        return; done = true; clearTimeout(timer); signal?.removeEventListener('abort', abort); worker.terminate(); error ? reject(error) : resolve(value); }; const abort = () => finish(Error('REFUSE·wasm cancelled')); const timer = setTimeout(() => finish(Error('REFUSE·wasm worker lifetime')), lifetimeMs); signal?.addEventListener('abort', abort, { once: true }); const message = (raw) => { const data = raw; if (!data || typeof data !== 'object' || typeof data.ok !== 'boolean') {
+        finish(Error('REFUSE·wasm malformed worker result'));
+        return;
+    } if (data.ok) {
+        if (!data.result || typeof data.result.output !== 'string') {
+            finish(Error('REFUSE·wasm malformed worker output'));
+            return;
+        }
+        finish(null, data.result);
+    }
+    else
+        finish(Error(typeof data.error === 'string' ? data.error : 'REFUSE·wasm worker failure')); }; if (typeof worker.addEventListener === 'function') {
+        worker.addEventListener('message', e => message(e.data));
+        worker.addEventListener('error', e => finish(Error('REFUSE·wasm worker ' + e.message)));
+    }
+    else {
+        if (!worker.on) {
+            finish(Error('REFUSE·wasm worker event port'));
+            return;
+        }
+        worker.on('message', message);
+        worker.on('error', e => finish(e instanceof Error ? e : Error(String(e))));
+    } if (signal?.aborted) {
+        abort();
+        return;
+    } try {
+        worker.postMessage(request);
+    }
+    catch {
+        finish(Error('REFUSE·wasm request is not cloneable'));
+    } });
+}

package/dist/wasm/node-worker.js

@@ -0,0 +1,13 @@
+import { parentPort } from 'node:worker_threads';
+import { runWasmRequest } from "./adapter.js";
+if (!parentPort)
+    throw Error('REFUSE·wasm worker port missing');
+const port = parentPort;
+port.once('message', async (request) => {
+    try {
+        port.postMessage({ ok: true, result: await runWasmRequest(request) });
+    }
+    catch (error) {
+        port.postMessage({ ok: false, error: error instanceof Error ? error.message : String(error) });
+    }
+});

package/dist/wasm/object.js

@@ -0,0 +1,76 @@
+import { readFileSync } from 'node:fs';
+import { Worker } from 'node:worker_threads';
+import { sha256 } from "../host/hash.js";
+import { toposAt } from "../host/selected-topos.js";
+import { storeOf } from "../land/ledger.js";
+import { evaluateWasm } from "./adapter.js";
+function refuse(cause) { throw Error('REFUSE·wasm object ' + cause); }
+/** Configuration is the caller's already authenticated, live standing; selection grants no authority. */
+export function usesWasmObject(configuration) {
+    const rows = configuration.filter(f => f.scope === 'engine/object' && f.value !== 'withdraw');
+    if (!rows.length)
+        return false;
+    if (rows.length !== 1 || rows[0].role !== 'writes' || rows[0].measure !== 'id' || rows[0].form !== 'alphabet' || !['esm@1', 'wasm@1'].includes(rows[0].value ?? ''))
+        refuse('unique declared backend required');
+    return rows[0].value === 'wasm@1';
+}
+function limit(configuration, name, measure) {
+    const rows = configuration.filter(f => f.scope === 'engine/wasm/' + name && f.value !== 'withdraw');
+    if (rows.length !== 1 || rows[0].form !== 'interval' || rows[0].measure !== measure || rows[0].role !== 'writes')
+        refuse('missing or ambiguous ' + name + ' limit');
+    const span = /^(0|[1-9][0-9]*)\.\.(0|[1-9][0-9]*)$/.exec(rows[0].value ?? '');
+    if (!span || !Number.isSafeInteger(Number(span[1])) || !Number.isSafeInteger(Number(span[2])) || Number(span[1]) > Number(span[2]) || Number(span[2]) < 1)
+        refuse('invalid ' + name + ' limit');
+    return Number(span[2]);
+}
+/** The installed instrument owns the asset/form closure; place input cannot choose executable bytes. */
+export async function foldObjectsWithWasm(root, records, context, configuration, signal) {
+    if (!usesWasmObject(configuration))
+        refuse('backend not selected');
+    const limits = { memoryBytes: limit(configuration, 'memory', 'bytes'), stackBytes: limit(configuration, 'stack', 'bytes'), executionMs: limit(configuration, 'execution', 'milliseconds') }, lifetimeMs = limit(configuration, 'worker-lifetime', 'milliseconds'), responseBytes = limit(configuration, 'response', 'bytes');
+    const assets = new URL('../../assets/wasm/', import.meta.url), manifest = JSON.parse(readFileSync(new URL('manifest.json', assets), 'utf8'));
+    if (!manifest.forms)
+        refuse('installed form closure missing');
+    const codecs = {};
+    for (const record of records.filter(r => r.record === 'cell')) {
+        const pin = record.fields.topos, binding = manifest.forms[pin];
+        if (!binding || !['intervalForm', 'alphabetOfForm'].includes(binding.export) || binding.form !== record.fields.form)
+            refuse('unsupported form standing ' + pin);
+        const standing = toposAt(pin, storeOf(root)), selector = standing.parts.filter(f => f.scope === 'wire/topos/context-view');
+        if (selector.length !== 1)
+            refuse('context selection ' + pin);
+        const offers = standing.parts.filter(f => f.kind === 'check' && f.view === selector[0].value);
+        if (offers.length !== 1 || offers[0].value !== binding.contextArtifact || !(offers[0].restsOn ?? '').split('|').includes(binding.contextArtifact))
+            refuse('context implementation differs ' + pin);
+        const selected = context.resolve(record);
+        if (selected.digest !== pin || selected.form.id !== binding.form)
+            refuse('prepared form differs ' + record.fields.scope);
+        codecs[record.fields.scope] = { digest: pin, export: binding.export, params: selected.params };
+    }
+    const guestNames = Object.keys(manifest.modules);
+    if (guestNames.length !== 1)
+        refuse('installed guest module map');
+    const guestName = guestNames[0];
+    let program;
+    try {
+        program = `import{objectFold,intervalForm,alphabetOfForm}from${JSON.stringify(guestName)};const forms={intervalForm,alphabetOfForm},codecs=${JSON.stringify(codecs)},records=${JSON.stringify(records)};const context={resolve:cell=>{const c=codecs[cell.fields.scope];if(!c)throw Error('REFUSE unknown prepared cell');return{digest:c.digest,form:forms[c.export],params:c.params}}};globalThis.result=JSON.stringify(objectFold(records,context));`;
+    }
+    catch {
+        return refuse('context is not serializable');
+    }
+    const entry = guestName + '.entry', programDigest = sha256(program);
+    const guest = readFileSync(new URL('guest.js', assets), 'utf8'), modules = { [guestName]: guest, [entry]: program }, request = { trusted: { ...manifest, modules: { ...manifest.modules, [entry]: programDigest }, entry, aliases: {}, limits, byteLengths: { ...manifest.byteLengths, modules: { ...manifest.byteLengths.modules, [entry]: Buffer.byteLength(program) } } }, assets: { runtime: new Uint8Array(readFileSync(new URL('runtime.js', assets))), wasm: new Uint8Array(readFileSync(new URL('runtime.wasm', assets))) }, modules, entry, aliases: {}, limits };
+    const result = await evaluateWasm(request, { workerFactory: () => new Worker(new URL('./node-worker.js', import.meta.url)), lifetimeMs, ...(signal ? { signal } : {}) });
+    if (Buffer.byteLength(result.output) > responseBytes)
+        refuse('response bytes limit');
+    let readings;
+    try {
+        readings = JSON.parse(result.output);
+    }
+    catch {
+        return refuse('invalid projection text');
+    }
+    if (!Array.isArray(readings) || readings.some(r => !r || typeof r.cell !== 'string' || typeof r.state !== 'string'))
+        refuse('invalid projection shape');
+    return readings;
+}

package/dist/wasm/worker.js

@@ -0,0 +1,7 @@
+import { runWasmRequest } from "./adapter.js";
+self.onmessage = async ({ data }) => { try {
+    self.postMessage({ ok: true, result: await runWasmRequest(data) });
+}
+catch (error) {
+    self.postMessage({ ok: false, error: String(error) });
+} };

package/docs/contracts/authenticated-reference.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/authenticated-reference",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/reference-port.md",
+      "digest": "sha256:d6198b9ab177086cb334e9e9cd7adb5c67b0af7165a79d23812aa2496d17674c"
+    },
+    {
+      "role": "yes",
+      "path": "samples/authenticated-reference/yes/weather-reading/inputs/yes.json",
+      "digest": "sha256:f285a014cc9e9453aebd4c4ed94354fba5cac55c05929f4ad7cdd1b3348a9717"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/authenticated-reference.vector.json",
+      "digest": "sha256:9aba7121fbbb98e63259dea78e52377cd71c628e0d17be20c9a51da27f2b31de"
+    },
+    {
+      "role": "no",
+      "path": "samples/authenticated-reference/yes/weather-reading/inputs/signature.json",
+      "digest": "sha256:2049bbbf88077727911a0cfec3193ab6ce7bccb8d4e3bb22fc537c59f5addf58"
+    }
+  ]
+}

package/docs/contracts/engine-object-projection.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/engine-object-projection",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/engine.md",
+      "digest": "sha256:2d54ddc75386a0706a3bc500e36deedc85ca9e7dc965eff5c795f02b1a716078"
+    },
+    {
+      "role": "yes",
+      "path": "samples/engine-interval/inputs/sample.json",
+      "digest": "sha256:ef476bda8c15b4967a88dc27a188ab25cfac42bdf381fb82f4e57a482d2fd27d"
+    },
+    {
+      "role": "no",
+      "path": "samples/no/engine-order/inputs/sample.json",
+      "digest": "sha256:f2104a661541baf7f8e6d9224590210b272e24519dafce94ca7c588e5a78a20d"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/engine-object.cli.json",
+      "digest": "sha256:191920f597e2d8bafc9aeeff13934645c64a790dcad94b22c562b30c5fe6baa0"
+    }
+  ]
+}

package/docs/contracts/engine.md

@@ -0,0 +1,39 @@
+# Pure object projection
+
+`@lapxo/bound/engine` exports `objectFold` and the existing `ObjectReading`, `ObjectRecord` and `ObjectContext` types. The CLI and receipt paths use that same implementation. Its Obligations 0.3.5 algebra is unchanged.
+
+The input is authenticated and context-admitted effective history with selected deterministic forms and parameters. This function does not admit records, verify signatures, resolve content, run commands, select clocks or write storage. Applications must perform preparation before projection.
+
+Within each epoch, a cell declaration precedes its uses in effective order. A same-epoch act before its cell refuses in preparation by name: `object context: cell not declared before <act-id>`. Lower-epoch cell declarations remain eligible even when their envelope arrives later. Effective sign/join order is preserved; transport arrival does not authorize arbitrary semantic reordering. The consumed Topos contract must be published before this export is admitted for release.
+
+Outputs preserve existing attributed origins, local and travelling marks, exact withdrawals, floor and ceiling parts and REQUIRED/FREE/FORBIDDEN/CONFLICT decisions. Raw object JSON is not a new canonical identity. Byte identity requires the existing declared reading projection.
+
+Malformed or unauthenticated records are outside this pure projector's input contract. Refusal, authority and interrupted-admission vectors exercise the host boundary; they do not claim cryptographic admission inside WASM. No host callback calculates an algebraic result in a WASM comparison.
+
+## Public conformance samples
+
+`samples/engine-interval` and `samples/engine-alphabet` are formed places: TARGET.bound, receipts.bound, package.json, the declared reader.js and inputs/sample.json. The instrument exercises the same projector against prepared fixtures; its reader is not a command users invoke. `fold <sample-directory> --check` verifies each portable receipt. Cold native `fold --as receipts` recomputes the declared conformance reading without a private store.
+
+`samples/no/engine-interval.json` and `samples/no/engine-alphabet.json` are negative data fixtures. Their captured native preparation refusal is `cell not declared before s-B`; no closed receipts are asserted for refusing input. The actual CLI vector is `vectors/engine-object.cli.json`. This conformance reader does not authenticate arbitrary signatures, coverage or clocks.
+
+
+## Optional WASM host adapter
+
+The optional `@lapxo/bound/wasm` entry evaluates the existing pure projection in QuickJS WASM. It performs no admission, signature verification, state calculation of its own, transport, key discovery or effects. Host authentication must finish before records become projection inputs. A valid digest identifies bytes; it grants no authority or confinement guarantee.
+
+The host supplies the trusted runtime/WASM/module digests, exact byte lengths, entry, aliases and limits. These expectations must come from its accepted configuration, independently of fetched place bytes. Closed request metadata and exact lengths are checked before copying, hashing or worker handoff. Shared assets refuse. Every supplied byte is verified and copied before execution; the closed runtime bundle has no imports and receives the already verified WASM binary. Guest imports resolve only within the verified module map. No second fetch occurs.
+
+`runWasmRequest` returns declared text, without inventing a JSON canonicalization or number policy. The caller's declared entry chooses the serialization contract. Memory and stack limits govern the guest; they do not describe total host/WASM initialization memory. Guest memory, stack and execution budgets are explicit host inputs. Initialization and execution times are separate readings, not a speed guarantee.
+
+`evaluateWasm` runs in a host worker. It accepts an AbortSignal and an explicit worker lifetime. Cancellation, timeout, malformed messages, failed serialization and worker errors terminate the worker and return no successful result. Guest state remains provisional until success; no host write port is supplied. A terminated computation produces no successful receipt. The direct `runWasmRequest` entry has deadline interruption but cannot asynchronously receive an external abort while synchronously executing; callers needing that contract use `evaluateWasm`.
+
+
+### Native optional WASM projection
+
+The existing object view consumes an optional, authenticated live declaration `engine/object form=alphabet measure=id value=wasm@1`. With no selector it retains the ESM projection; a conflicting or unknown selector refuses. This profile selects only the explicit object view, not every other view of the place. The host admits and folds configuration with the existing authority and withdrawal rules before selecting execution.
+
+The place declares five interval limits: `engine/wasm/memory`, `engine/wasm/stack` and `engine/wasm/response` in bytes; `engine/wasm/execution` and `engine/wasm/worker-lifetime` in milliseconds. Missing, ambiguous or invalid limits refuse; there is no inferred fallback. The installed instrument binds the guest module and supported form standings to their context implementation artifacts. A place cannot choose another verifier or executable through this selection; an unsupported form or different implementation refuses.
+
+Context initialization is measured before place execution. If observed initialized guest memory exceeds the declared memory budget, the operation refuses without running place code. Host initialization memory is outside that guest execution limit; the worker lifetime bounds the entire attempt. During execution the unchanged declared memory, stack and execution limits apply. SIGINT reaches the worker cancellation port; cancellation or failure emits no successful object result.
+
+For the opt-in `wasm@1` profile, the host verifies the selected context implementation before importing it. Every SHA-256 member declared by the context offer’s `restsOn` is checked by digest, and the existing `moduleClosure` validates the imported closure. Missing, altered, undeclared or unresolved imported members refuse before context code executes. This establishes content identity and import closure, not correctness, authority or sandbox confinement. Admission still precedes projection, and this check grants no permission to reuse a retained answer as current.

package/docs/contracts/host-ports.md

@@ -0,0 +1,23 @@
+# Public host ports
+
+`/engine` and `/reference` export `readContent`, `retainContent` and `invokeSigningPort`, with `ContentReadPort`, `PersistencePort`, `SigningPort`, `DigestPort` and `PortLimits`. There is no default network, store, account or signer. `objectFold` remains pure and never calls a port.
+
+Every operation takes an explicit positive safe-integer `timeoutMs` and `maxBytes`, and an optional AbortSignal. Invalid limits and pre-cancellation refuse before the callback. Acquisition, digest calculation and retention share the operation lifetime. A timeout aborts the supplied signal and returns no successful result. This is a cooperative host boundary, not preemption of synchronous JavaScript or sandbox confinement.
+
+`readContent(source, digest, ports, limits, signal)` invokes the supplied read callback and SHA-256 callback, checks byte bounds before copying/hashing, rejects shared buffers, and verifies an owned snapshot against the requested digest. Location carries no authority.
+
+`retainContent(digest, bytes, ports, limits, signal)` checks identity before calling the host's atomic byte-retention callback. Its acknowledgement contains only digest and byte count. It is not a signed receipt, admission or permission to reuse a response. The host must implement atomic retention and cooperate with cancellation. A callback that ignores cancellation may finish retaining bytes after the caller has refused; no success, act or authority follows from those bytes. Opening and projection never retain automatically.
+
+`invokeSigningPort(lot, sign, limits, signal)` uses the existing Topos signing request/response framing. It acquires protocol-shaped signatures; it does not decide authority or certify them cryptographically. Native export can receive `hostSigner: {name, sign}` through `/reference/native`. The name must match the admitted signer selection, and cannot be combined with a key-file override. The existing consent path verifies every returned signature against the admitted key, era, scope and epoch before returning a carrier. No key material enters the engine.
+
+Native opening accepts `content: {name, read}`. Its name must match the admitted transport selection, with that selection's existing byte and lifetime bounds. The host callback cannot be chosen by a carrier, reference or repository. The existing inspector verifies the returned carrier again and the selected backend projects only verified records. There is no backend fallback.
+
+Public port failures use the machine refusal catalog: `host-port/budget`, `cancelled`, `timeout`, `failed`, `integrity`, `response`. Native acquisition failures retain their enclosing reference refusal. Host diagnostics are not returned as authority or parsed as codes.
+
+Native vector output, in two real admitted places:
+
+```text
+PORTS owned content · verified retention · signer content persistence failures · budget integrity cancellation timeout refused
+HOST host-sensor · declared signer and content injected · real signature verified · wrong binding refused · no commit
+HOST host-editorial · declared signer and content injected · real signature verified · wrong binding refused · no commit
+```

package/docs/contracts/host-ports.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/host-ports",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/host-ports.md",
+      "digest": "sha256:f3d646da2399c719469a37293b329d53b72b0478ca97f961b90c1f4e6adc2ae6"
+    },
+    {
+      "role": "yes",
+      "path": "samples/host-ports/yes.json",
+      "digest": "sha256:f8dc3c6939bd8f4bb91cb57e3e9b52a865645cc80ee0f5ce5a11570ef3f31ce3"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/host-ports.vector.json",
+      "digest": "sha256:58425f81fb4f1ef6e392d8fa3a5ee3a287ef6fbcbfb11e512fd2e30f24f465e6"
+    },
+    {
+      "role": "no",
+      "path": "samples/host-ports/no.json",
+      "digest": "sha256:ffc9dbb29743d4faa16c5c29eb73a7e0f24cf4da3255a979f628f5c3d8f4b7c1"
+    }
+  ]
+}

package/docs/contracts/native-publication.inventory.json

@@ -0,0 +1,14 @@
+{
+  "profile": "quartet-process@1",
+  "scope": "contract/published/native",
+  "surface": [
+    "contract/published/optional-wasm-adapter",
+    "contract/published/authenticated-reference",
+    "contract/published/reference-export",
+    "contract/published/reference-backend",
+    "contract/published/standing",
+    "contract/published/refusals",
+    "contract/published/host-ports",
+    "contract/published/readme"
+  ]
+}

package/docs/contracts/optional-wasm-adapter.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/optional-wasm-adapter",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/engine.md",
+      "digest": "sha256:2d54ddc75386a0706a3bc500e36deedc85ca9e7dc965eff5c795f02b1a716078"
+    },
+    {
+      "role": "yes",
+      "path": "samples/wasm/water-level/TARGET.bound",
+      "digest": "sha256:d2f3efc176a6fa7f695dcaab93ed6f35fac4e601d0b7e47f485ac15109d11a0c"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/wasm-object.cli.json",
+      "digest": "sha256:f0b970ede31b99e00e94f249970aa8c714880dccb03ed7952a3cf01bf24a7c17"
+    },
+    {
+      "role": "no",
+      "path": "samples/wasm/water-level/no-memory.bound",
+      "digest": "sha256:4c30cb6c77a9079a5961f0ff50c53830ad2c7ca8526ef63aa7c3eb4fa2af4554"
+    }
+  ]
+}

package/docs/contracts/publication-additions.inventory.json

@@ -0,0 +1,8 @@
+{
+  "profile": "quartet-process@1",
+  "scope": "contract/published/additions",
+  "surface": [
+    "contract/published/engine-object-projection",
+    "contract/published/reference-port"
+  ]
+}

package/docs/contracts/readme.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/readme",
+  "members": [
+    {
+      "role": "contract",
+      "path": "README.md",
+      "digest": "sha256:183fe27e7a8bfdb04f4aefaa785f2b1845da1c5a93562a06a300175a960c72da"
+    },
+    {
+      "role": "yes",
+      "path": "samples/readme/yes.json",
+      "digest": "sha256:37449e6ec4867f034463ca20218d370fe40c1d5dec759871c398fd73109f9f6e"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/readme.vector.json",
+      "digest": "sha256:b97b50e102fb6c34851d2769d6029663fb4838e2eb70a9bdb4c168141b8964f3"
+    },
+    {
+      "role": "no",
+      "path": "samples/readme/no.json",
+      "digest": "sha256:6bb243445b009fd94ba021342fca34ea00cf4c5257378d9d7c05840c13166f73"
+    }
+  ]
+}

package/docs/contracts/reference-backend.md

@@ -0,0 +1,24 @@
+# Authenticated native reference opening
+
+`@lapxo/bound/reference/native` exports `exportAuthenticatedReference` and `openAuthenticatedReference`. This is the Node host boundary. The platform-free inspector stays in `/reference`; the pure projector stays in `/engine`.
+
+The receiver admits one `engine/object` declaration: `esm@1` or `wasm@1`. Missing, ambiguous and unknown selections refuse. WASM never falls back to ESM. The native route shares one context preparation, authenticates the received original records, then calls the existing selected projector. It introduces no algebra or alternate interpreter.
+
+The host admits `reference/snapshot`, `reference/epoch`, `reference/proof-scope`, `reference/policy`, `reference/form-implementation`, `reference/records`, and the standing/refusal contract digests. The policy is the independently accepted export policy, not a policy invented from the received carrier. The prepared form implementation must match the admitted expectation, and both interpretation contracts must match the installed bytes. A carrier's accompanying context is public data, not an authority anchor.
+
+Content goes through the declared transport and its existing byte/time limits. The snapshot binds the declared public context, including resource budgets. The native opener accepts an AbortSignal and checks interruption before download and projection; the WASM worker uses its existing cancellation and lifetime contract. This does not claim cancellation of an in-flight native download, browser persistence or arbitrary browser capsules.
+
+WASM uses the installed asset manifest, runtime, guest and exact supported form standings. The caller cannot replace that manifest with a convenient fixture. Its memory, stack, execution, worker-lifetime and response budgets remain explicit admitted interval lines. A form outside that installed closure refuses by name.
+
+The positive fixture uses the previously published native reader archive named in `samples/reference-backend/world-fixture.json`, or the same supported standing and closed modules already laid by digest. Preparation verifies every byte before timed opening. The fixture archive is fetched or retained outside opening measurements; no private store or checkout path identifies it. No provider code executes during archive preparation.
+
+The native quartet opens one signed reference in two unrelated places, once through each explicitly selected backend. It compares authenticated standing, records and canonical projection bytes. Authority-context identity describes authentication, not an execution receipt: equal outputs never authorize reuse of a receipt across implementations. Neither opening signs or commits an act.
+
+Captured semantic markers:
+
+```text
+WASM water-level-reference · authenticated download · same standing · same records · byte-equal ESM projection · altered carrier refused · no commit
+WASM editorial-reference · authenticated download · same standing · same records · byte-equal ESM projection · altered carrier refused · no commit
+```
+
+The no sample changes the carrier while retaining its reference. Integrity refuses before projection. Existing vectors also retain unknown-backend, unsupported-form, byte-budget, authority and cancellation boundaries. The quartet descriptor is `reference-backend.publication.json`; installed-archive release acceptance and L6 remain separate obligations.

package/docs/contracts/reference-backend.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/reference-backend",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/reference-backend.md",
+      "digest": "sha256:c69fbaac11276efcd8a436f242e07d4fda18137c9987f8bba183fe6d6ea801c6"
+    },
+    {
+      "role": "yes",
+      "path": "samples/reference-backend/yes.json",
+      "digest": "sha256:67657bf32a0b85053bf3778f8e1dc13478aaf7386e39200d6967cc9ff2ef5e6f"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/reference-backend.vector.json",
+      "digest": "sha256:05257cf22466c859eb01e1abf660927afb5a9a160d3865053ebdf8649f0f5392"
+    },
+    {
+      "role": "no",
+      "path": "samples/reference-backend/no.json",
+      "digest": "sha256:a4e3dd23533925d117954666eb68c4f54165af3263317c330beed6d13a216626"
+    }
+  ]
+}