Build a Native AOT Product

What AOT means here

The Native pipeline is explicit:

exact Lispex source
  -> lispex.core-ir/v1
  -> lispex.bytecode/v1
  -> readable generated Topaz + source map
  -> exact installed Topaz 5.11 compiler
  -> topaz.artifact.v1
  -> source-free Native product

The generated program contains a static control graph. It does not read Lispex source or bytecode at runtime and does not embed the Rust VM, tree interpreter, or separately installed Topaz VM.

Prepare the rule

Save refund-window.lspx:

(define (decide days)
  (if (<= days 30) 'refund 'review))

(decide input)

Save the input datum as request.lspx:

14

Select the build tools explicitly

AOT is currently a Native macOS ARM64 feature. Use absolute paths to the installed topaz-lang@5.11.0 compiler and its Rust tool directory:

TOPAZ_BIN=/absolute/path/to/node_modules/topaz-lang/bin/topaz-bin
RUST_TOOL_BIN=/absolute/path/to/rustup/bin

Lispex checks the exact Topaz package, compiler, npm wrapper, installer, and Rust tool proxies. It never searches PATH, a repository checkout, the network, an older toolchain, or a cached alternate product.

Build without overwriting

lispex aot build \
  --source refund-window.lspx \
  --topaz-compiler "$TOPAZ_BIN" \
  --rust-tool-bin "$RUST_TOOL_BIN" \
  --out refund-window-aot

The destination must not exist. Lispex builds in bounded private staging, strictly validates the compiler-emitted Topaz artifact and every managed file, then removes path-sensitive local linker symbols and replaces the linker signature with one fixed ad-hoc Lispex AOT signature. The product manifest records the exact /usr/bin/strip and /usr/bin/codesign hashes, and the final Topaz artifact is rebound to the finalized executable. Lispex writes its manifest last and atomically publishes the closed product.

The installed directory contains only:

lispex-aot-product.json
lispex-source-map.json
topaz-artifact.json
target/debug/program
LICENSE
NOTICE
GENERATED-OUTPUT-NOTICE.txt

Generated Topaz and original Lispex source are not required to run it.

Inspect and validate without execution

lispex aot inspect --product "$PWD/refund-window-aot"
lispex aot validate --product "$PWD/refund-window-aot"

Both commands require an absolute product root. They verify the closed file inventory, source/Core IR/bytecode/AOT identities, source map, exact compiler and macOS finalizer lineage, Topaz artifact, executable hash, target, and zero fallback counters. Neither command starts the executable.

Run the installed product

lispex aot run \
  --product "$PWD/refund-window-aot" \
  --input request.lspx

refund

run revalidates the installed product and starts only its recorded executable. It never compiles and never retries the tree interpreter, Rust VM, Topaz VM, bytecode parser, network, or another installation.

For a machine-readable result:

lispex aot run \
  --product "$PWD/refund-window-aot" \
  --input request.lspx \
  --json

The result binds the product manifest, source, Core IR, bytecode, generated Topaz bundle, source map, Topaz artifact, executable, input, requested resources, observations, and five zero fallback counters.

Set resource limits

lispex aot run \
  --product "$PWD/refund-window-aot" \
  --input request.lspx \
  --machine-transitions 1000000 \
  --output-bytes 1048576 \
  --control-frames 10000 \
  --json

All three values are canonical unsigned 64-bit decimals. Leading zeroes, signs, overflow, mismatched accounting, or an impossible success/diagnostic combination fail closed. Different engines can charge different resource models, so compare like-for-like requests rather than treating equal numbers as a proof of semantic equivalence. A reached resource limit remains a typed fault result with its diagnostic and observed counters; the Native parent does not discard that JSON merely because the AOT process exits unsuccessfully.

Compare all four Native routes

After building the AOT product, you can run the Rust tree, built-in Rust VM, exact installed Topaz VM, and AOT executable for one source and input:

lispex compare-routes \
  --topaz-vm /absolute/path/to/aarch64-apple-darwin \
  --aot-product "$PWD/refund-window-aot" \
  --receipt four-routes.json \
  --input request.lspx \
  refund-window.lspx

Lispex parses and normalizes the source once, derives one Core IR and bytecode artifact, proves that the prebuilt AOT product binds those exact identities, validates both installed Topaz products, and then runs every route explicitly. It never retries a failed route.

The no-clobber receipt keeps semantic mismatch axes separate from comparable resource mismatch axes. Rust VM, Topaz VM, and AOT share the bytecode cost model and must agree on transition, output, control-frame, and completed-root counts. The tree reports its different depth model honestly, so unavailable tree transition and frame counts are not invented. Exit 0 means all routes completed and every checked axis agreed; 1 means a checked mismatch; 2 means an execution or product failure; 3 means the receipt could not be published.

Security boundary

An AOT executable, product manifest, source map, inspection, validation, or run report—and the four-route receipt—is execution-material-only or local diagnostic evidence. None is Vouch authentication evidence, a request-bound re-execution result, or a gate grant. The current Vouch chain continues to use exact external source and input with its tree/Meaning/Rust-VM boundary.

Rust tree and Rust VM remain independently available recovery routes. AOT failure is visible and does not select either route automatically.

Product support

The current route is an unoptimized correctness-first AOT product. Its byte-identical rebuild claim is limited to the recorded compiler, Rust, and macOS finalizer identities on the current host; it is not a cross-host reproducible-build claim. It does not promise smaller binaries, faster execution, cross-compilation, a stable ABI, formal equivalence, publisher authenticity, or Vouch authority.

Run Verified Bytecode · Native CLI · Runtime and Backends