How to reason about it
- Implemented: deterministic numeric tower, lexical mutation, proper tail calls, multiple values, exceptions/guard, one-shot escape continuation, immutable aggregates plus mutable vectors, and the listed library.
- Deferred: multi-shot continuations/re-entry, ports and general I/O, transcendentals, mutable pairs/strings/bytevectors, exact Unicode folding, and user macros.
- LIL implements all 205 versioned primitive capability rows; LIT independently implements 84 and rejects 121. Backend admission does not widen the language profile.
- Future work requires an explicit semantic decision and coordinated spec, implementation, tests, and evidence update.
- The request-bound authority chain does not widen Rust 205/205, LIL 205/205, LIT 84/205, or the historical 59/144 all-family agreement boundary.
- Canonical images add a reversible representation of exact source bytes, not a datum, primitive, reader syntax, language feature, compiler, or new semantic profile.
- Lispex Image ingress changes only how exact source bytes enter Vouch. It adds no receipt, bundle, policy, report, or gate schema, no language semantics, and no browser Vouch authority.
- Canonical Core IR and verified bytecode compile the existing profile. The Native Rust VM adds a selectable execution structure, not new guest syntax, ambient I/O, or a fourth backend family. Vouch may explicitly require this same-lineage VM only after exact source derivation and every existing request-bound check.
- The exact installed Topaz 5.11 VM runs the same verified bytecode only on an explicit macOS ARM64 Native route. Lispex validates product, request, result, full-width resource counters, and zero fallback. The route is outside Vouch and is bounded comparison evidence, not whole-language equivalence proof.
Three labels prevent scope confusion
profile-requiredlabels all 205 capabilities in the current language denominator. Backend support is measured separately.host-adapter-onlylabels ambient filesystem, network, clock, randomness, process, and environment access. A host may perform such work around a Lispex invocation, but it is not ambient guest semantics.future-profilelabels considered semantic features that are not current language capabilities, such as full multi-shot continuation re-entry, guest input, transcendentals, extra mutation, UTF-8 codecs, and exact Unicode folding.
These are decisions, not implementation excuses or release promises.
Scope ledger
| Area | Current | Deferred |
|---|---|---|
| Control | one-shot upward call/cc, dynamic-wind, handlers, guard | multi-shot continuation and dynamic re-entry |
| Numbers | exact integers/rationals and finite real; exact integer exponent/sqrt | complex and platform transcendentals |
| Mutation | lexical cells and vectors | mutable pairs, strings, bytevectors |
| Effects | canonical output and explicit invocation boundaries | ports, files, network, time, randomness |
| Source tooling | Native lossless-layout fmt, quiet check, safe write, and editor delegation to the installed CLI | npm/browser formatting, structural line reflow, LSP, completion, or diagnostics |
| Metaprogramming | built-in hygienic derived-form normalization | user macros and define-syntax |
| Backend coverage | Rust reference and LIL each cover the current 205-row capability denominator; LIT remains at 84/205, and the exact 144-case released joint receipt measures the earlier shared 84-row boundary | unscoped whole-language parity, LIT source independence, or the 121 LIT unsupported rows |
| Compiled execution | Native canonical Core IR inspection, canonical lispex.bytecode/v1, strict verification, explicit Rust and exact installed Topaz VMs, and on macOS ARM64 a source-free correctness-first AOT product plus one no-clobber tree/Rust VM/Topaz VM/AOT comparison receipt; every route is explicit and no-fallback | arbitrary artifact or comparison report as authority, Topaz-backed compiled Vouch, npm/browser VM or AOT, independent-equivalence proof, direct WASM, cross-compilation, optimized/stable ABI claims, new syntax, or ambient capabilities |
| Exact image representation | same-Rust Native/npm/browser/Playground canonical PNG/ZIP encode, inspection, proved page view, byte-exact recovery, download, separate explicit run where the surface provides UI, and bounded Vouch source ingress on Native/npm | OCR, camera recovery, transformation tolerance, secrecy, signatures, independent-witness claims, or authority |
| Public identity tools | Native/npm key-id, engine-id, source-id, and input-id derive the existing exact evidence and policy values through shared Rust | key/executable provenance, trust, input parsing or approval, authentication, evidence, freshness, replay control, or execution authority |
| Policy configuration | shared-Rust canonical policy v1 creation/checking from reviewed Ed25519 SPKI, engine digests, and exact source bytes in Native/npm | private-key handling, automatic enrollment, artifact-derived trust, policy correctness, authentication, evidence, gate authority, or browser tooling |
| Source identity derivation | shared-Rust SHA-256("csk.v0.source" || 0x1f || exact source bytes) in Native/npm | ordinary SHA-256, normalization, source approval, policy generation, artifact trust, authentication, or evidence |
| Source authorization | selected-key allowlist over exact domain-separated source bytes in trust policy v1 | input/request approval, rule correctness, freshness, replay prevention, identity, or external-action authority |
| Portable input transport | one 16 MiB canonical envelope/source/input bundle; raw fallback remains | language denominator, LIL/LIT rows, released receipt, freshness, replay prevention, or authority |
A common mistake
Deferred features must not be inferred from another Scheme implementation.
The current LIL surface includes every composed pair accessor from caar to
cddddr. Read the letters from right to left: (caddr x) is
(car (cdr (cdr x))). This is an implementation-coverage improvement, not a
new language primitive or a wider profile.
The same boundary now covers seven small derived procedures inside LIL:
abs, square, zero?, positive?, negative?, boolean=?, and
symbol=?. They reuse existing profile operations; they do not add host
capabilities or alter the language denominator.
The current LIL boundary also includes the finite-real complex?, rational?,
and real? predicates, structural !=, and the
memv/assoc/assq/assv search family. Their different comparison rules
are preserved: assoc uses structural equality, while the other three
searches use the current eq?/eqv? identity rule.
Case-sensitive character and string ordering is also available in LIL:
char<?, char<=?, char>?, char>=?, string<?, string<=?,
string>?, and string>=?. They expose the existing Unicode scalar order;
case folding and locale-aware collation remain separate.
LIL also covers list-copy, list-ref/nth, list-tail, make-list,
make-string, string->vector, and vector->string. List copies have fresh
pair spines, list tails share their original structure, default fills are
deterministic, and string/vector slices count Unicode characters rather than
UTF-8 bytes. These are implementations of existing profile rows, not new
language semantics.
The current LIL boundary also admits character/string case classification,
conversion, and case-insensitive order through a declared Unicode host kernel:
char-ci<? and the other char-ci comparisons, string-ci<? and its order
family, char-whitespace?, char-foldcase, and
string-upcase/string-downcase/string-foldcase.
Character mappings are simple and single-character; string mappings are full
and may expand. The v1 foldcase contract remains the documented
lowercase-based approximation rather than complete Unicode CaseFolding.
Recorded host-kernel support is not an independent implementation or hidden
fallback.
The current LIL boundary now also includes floor, ceiling, round,
truncate, exact, inexact, inexact->exact, exact->inexact, even?,
odd?, min, and max. Rounding preserves exactness and round uses
half-to-even. Converting 0.5 with exact yields the exact dyadic 1/2,
not a decimal-text interpretation. Parity requires an integer, while
min/max compare the mixed numeric tower exactly and return an inexact
result if any input is inexact. LIL owns validation and the two folds; its
declared numeric host kernel owns the scalar arithmetic.
LIL also implements modulo, quotient, remainder,
floor-quotient, floor-remainder, floor/, truncate-quotient,
truncate-remainder, truncate/, gcd, and lcm with exact integer
intermediates and documented inexact contagion. The floor and truncate
families retain their different sign rules, and the slash forms return two
values. Deterministic expt remains limited to an exact-integer exponent;
exact-integer-sqrt returns root and remainder. Those two advanced operations
use the declared numeric host kernel, while general transcendental powers
remain outside the current language profile.
LIL now also executes all twelve collection HOF rows itself: all?, any?,
filter, fold-left, fold-right, for-each, map, reduce,
string-for-each, string-map, vector-for-each, and vector-map.
Explicit continuation frames preserve callback order, short-circuiting, value
cardinality, errors, and escapes without a host callback. The string and
vector forms snapshot their input before traversal.
LIL also writes display, write, newline, and println through a bounded
private effect sink. Explicit output and top-level auto-print share their exact
stdout order, while completed root values remain a separate receipt
projection. Output procedures return zero values, and output already written
survives a later runtime error.
LIL also preserves the three compatibility spellings %, list-first, and
list-rest. Prefer modulo, first, and rest in new code. A genuine
deprecated primitive call records W330 or W331 once per source call site in
first-occurrence order; a shadowing binding does not warn, and the warning
remains visible if the delegated operation later fails. Warnings stay separate
from stdout, values, and error diagnostics.
Keep going
Use this page while writing code. For a guided explanation, return to the syntax map or the corresponding manual.