Outcome
Use CEL only for pure authored predicates and formulas that benefit from data-driven expression, with deterministic semantics and strict resource limits.
Scope and invariants
- Create separate versioned environments for quest conditions, dialogue visibility, item/activity prerequisites, achievement predicates, and explicitly approved formulas.
- Expose small typed immutable values/functions; forbid filesystem, network, reflection, mutation, wall time, ambient randomness, unbounded collections, and host object leakage.
- Compile/type-check expressions in
content-toolkit, revalidate/load checked programs in Go, and record environment version/capabilities in artifacts.
- Define numeric types/overflow, null/unknown/error behavior, fail-closed policy, cost accounting, AST/depth/collection/output limits, and cancellation.
- Cache programs by artifact digest without sharing mutable activation state.
Acceptance criteria
- Positive/negative conformance fixtures execute identically at content-build and server-load/evaluation boundaries.
- Fuzz and adversarial tests cover expensive comprehensions, deep ASTs, huge constants/collections, type confusion, errors, cancellation, and cache isolation.
- Every environment has a published symbol/type/function catalog and compatibility policy.
- CEL performs no gameplay effects; results feed typed Go transactions.
- M3 quest/dialog/activity scenarios demonstrate sufficient expressiveness without Starlark.
Dependencies and parallelization
Depends on content artifact contracts but can be built independently of gameplay domains. The Starlark decision #60 cannot approve overlap that belongs in CEL or native services.
Independent implementation
New code and tests are MIT-licensed independent work. Preserve public behavior and issue-level design choices, but do not copy or mechanically translate GPL server/Python implementation or tests. Mixed-license content remains external data with its own notices.
Outcome
Use CEL only for pure authored predicates and formulas that benefit from data-driven expression, with deterministic semantics and strict resource limits.
Scope and invariants
content-toolkit, revalidate/load checked programs in Go, and record environment version/capabilities in artifacts.Acceptance criteria
Dependencies and parallelization
Depends on content artifact contracts but can be built independently of gameplay domains. The Starlark decision #60 cannot approve overlap that belongs in CEL or native services.
Independent implementation
New code and tests are MIT-licensed independent work. Preserve public behavior and issue-level design choices, but do not copy or mechanically translate GPL server/Python implementation or tests. Mixed-license content remains external data with its own notices.