The current profile is intentionally smaller than full R7RS-small, and the hosted backends expose separate explicit boundaries: LIL at 85 of 205 primitive rows and LIT at 84.
Current guarantees
- Implemented: deterministic numeric tower, lexical mutation, proper tail calls, multiple values, exceptions/guard, one-shot escape continuation, immutable aggregates plus mutable vectors, and the listed library.
- Deferred: multi-shot continuations/re-entry, ports and general I/O, transcendentals, mutable pairs/strings/bytevectors, exact Unicode folding, and user macros.
- LIL implements 85 of the 205 versioned primitive capability rows and rejects 120 loudly; LIT independently implements 84 and rejects 121. Backend admission does not widen the language profile.
- Future work requires an explicit semantic decision and coordinated spec, implementation, tests, and evidence update.
- The request-bound authority chain does not widen Rust 205/205, LIL 85/205, LIT 84/205, or the historical 59/144 all-family agreement boundary.
- Canonical images add a reversible representation of exact source bytes, not a datum, primitive, reader syntax, language feature, compiler, or new semantic profile.
- Lispex Image ingress changes only how exact source bytes enter Vouch. It adds no receipt, bundle, policy, report, or gate schema, no language semantics, and no browser Vouch authority.
Scope ledger
| Area | Current | Deferred |
|---|---|---|
| Control | one-shot upward call/cc, dynamic-wind, handlers, guard | multi-shot continuation and dynamic re-entry |
| Numbers | exact integers/rationals and finite real; exact integer exponent/sqrt | complex and platform transcendentals |
| Mutation | lexical cells and vectors | mutable pairs, strings, bytevectors |
| Effects | canonical output and explicit invocation boundaries | ports, files, network, time, randomness |
| Metaprogramming | built-in hygienic derived-form normalization | user macros and define-syntax |
| Backend coverage | Rust reference plus current LIL 85/205 and LIT 84/205 boundaries; the exact 144-case released joint receipt measures their prior shared 84-row boundary | unscoped whole-language parity, LIT source independence, or the remaining 120 LIL and 121 LIT unsupported rows |
| Exact image representation | same-Rust Native/npm/browser/Playground canonical PNG/ZIP encode, inspection, proved page view, byte-exact recovery, download, separate explicit run where the surface provides UI, and bounded Vouch source ingress on Native/npm | OCR, camera recovery, transformation tolerance, secrecy, signatures, independent-witness claims, or authority |
| Public identity tools | Native/npm key-id, engine-id, source-id, and input-id derive the existing exact evidence and policy values through shared Rust | key/executable provenance, trust, input parsing or approval, authentication, evidence, freshness, replay control, or execution authority |
| Policy configuration | shared-Rust canonical policy v1 creation/checking from reviewed Ed25519 SPKI, engine digests, and exact source bytes in Native/npm | private-key handling, automatic enrollment, artifact-derived trust, policy correctness, authentication, evidence, gate authority, or browser tooling |
| Source identity derivation | shared-Rust SHA-256("csk.v0.source" || 0x1f || exact source bytes) in Native/npm | ordinary SHA-256, normalization, source approval, policy generation, artifact trust, authentication, or evidence |
| Source authorization | selected-key allowlist over exact domain-separated source bytes in trust policy v1 | input/request approval, rule correctness, freshness, replay prevention, identity, or external-action authority |
| Portable input transport | one 16 MiB canonical envelope/source/input bundle; raw fallback remains | language denominator, LIL/LIT rows, released receipt, freshness, replay prevention, or authority |
Boundaries
- Deferred features must not be inferred from another Scheme implementation.