0%

AIMS Export and Artifact Validation

Goal

Realize provenance exactly once and make closure part of the executable artifact’s existing construction and validation boundary.

Construction Contract

Use the actual post-bytecode builder and verifier seams named by the preceding audit. AIMS supplies the logical product; the executable builder closes and attaches it; the shared verifier checks references, identity uniqueness, deterministic order, fingerprint integrity, and completeness before publishing the artifact. Executors receive the already validated product.

The export adapts completed partition and ledger infrastructure, return contracts, user-drop facts, closure and protocol metadata, unwind obligations, and stable bytecode identities. It must not rerun ownership scans over lowered executor forms. Transitional code may exist only behind a one-way adapter at the AIMS export boundary and must carry an explicit retirement row owned by the final sunset section.

Validation Semantics

Missing, duplicate, stale, reordered, or tampered keys fail closed through the same artifact-validation channel used by bytecode-vm. A physical planner cannot repair an invalid logical product. A shared artifact cannot be accepted by one executor and rejected as logically incomplete by another.

Required Matrices

Exercise straight-line, branches, joins, back-edges, per-iteration allocations, TRMC-rewritten graphs, normal return, unwind, user destructors, closures, protocols, aggregate field paths, borrowed and owned contracts, FFI/external visibility, and intentionally malformed artifacts. Each fixture asserts one export invocation and one artifact identity across all consumers.

Completion Evidence

The single-export probe must demonstrate one realization, one validation boundary, deterministic fingerprints, total stable references, malformed-artifact rejection, and zero executor-local AIMS reanalysis.

Work Items

  • Implement the single AIMS export/freeze path on the landed bytecode artifact builder so provenance is realized once, validated once, fingerprinted once, and attached before the executable product becomes visible to any executor.
  • Adapt existing partition, class-ledger, return-contract, user-drop, closure, protocol, unwind, and boundary facts into the closed schema without recomputing ownership from lowered CFGs or executor layouts.
  • Extend the bytecode artifact verifier with AIMS closure, reference-totality, stable-ordering, fingerprint, call-boundary, event/drop uniqueness, and tamper checks; share its error model and fail-closed construction boundary.
  • Remove layout-sensitive or mechanism-sensitive funding/grouping from shared AIMS realization, including for-yield layout leaks and RcStrategy-shaped grouping; replace them with neutral facts consumed only after projection.
  • Build differential export fixtures that compare pre-freeze AIMS facts with the closed product for branches, loops, TRMC-rewritten control flow, unwind, user drops, closures, protocols, aggregates, borrowed calls, owned calls, and external boundaries.
  • Prove and test that every executor receives the same validated artifact instance and that no executor can request a private AIMS rerun, mutate logical facts, or bypass artifact validation.