Resource-Controlled Evaluator Contract

Contract set

The bundle manifest identifies the provider by its exact WebAssembly SHA-256. That identity follows the bytes across release archives and consumers.

Two evaluator components

The decision component runs the closed operation set recorded by its bundle. The full component runs all 205 generated primitive rows with zero Deferred rows under component identity lispex-evaluator/rust-vm-current-profile/1. It uses the LPXFAR01 envelope, while decision artifacts use LPXART01.

Both components preserve the same v1 interface, value codec, transcript, and portable-core contracts. Native selects the full component through explicit embed full commands.

Interface and lifecycle

The module has zero imports, one memory with 18 initial and 256 maximum pages, and exports allocation, deallocation, interface-version, prepare, and evaluate functions with standard memory boundary globals. Requests use length-delimited, big-endian fields and the byte values declared by the caller.

Every operation creates a fresh Wasmtime Store, Instance, memory, allocator, guest heap, interner, cells, continuations, work counter, transcript, and result buffer. An immutable compiled Module can be shared under the exact WebAssembly identity.

Resource domains

Preparation owns raw_source_bytes, prepare_work, prepare_logical_allocation, and syntax_depth. Evaluation owns canonical_input_bytes, eval_work, eval_logical_allocation, semantic_frames, traversal_depth, output_bytes, diagnostic_bytes, transcript_bytes, transcript_events, and result_bytes.

Work uses a versioned deterministic tariff. Logical allocation uses units defined by the model. Charges occur before effects, use full u64, and stop at the first reservation beyond the selected value. Proper tail calls reuse the current semantic continuation.

Identity and results

The portable core binds the exact submitted source, canonical source, semantic rule, canonical input, resource contract, request, evaluator artifact, evaluation, transcript, and result through the lispex.evaluation-identity/v1 length-delimited SHA-256 construction.

An issuer can sign completed portable-core bytes through the decision-exchange and Vouch workflows.

Native decision directory

The Native workflow is:

rule run -> inspect -> verify -> replay

rule run accepts exact source and strict JSON files plus separate preparation and evaluation values. JSON objects become records, arrays become vectors, strings, booleans, and exact integers keep their value kinds, and null becomes the empty list.

A completed run creates five files in a new output directory.

inspect summarizes the directory, verify checks its member set and byte bindings, and replay evaluates the recorded request in a fresh instance and matches the result and portable core.

Distribution and product ownership

Native contains the exact provider bytes. Releases also publish the WebAssembly bundle, manifest, vectors, verifier material, software bill of materials, dependency dispositions, safety evidence, and append-only release-DAG records. Retained provider bytes keep historical receipts readable.

The host application owns source retention, network access, business policy, freshness, replay prevention, and external actions. Decision exchange owns issuer envelopes and recipient policy. Vouch owns signed evidence and the local decision gate. Topaz components keep their own compiler and admission identities.

Keep going

Use Embed Lispex for the Native workflow.