feat(ILO-392): sub-world masking (read-only, net-only, no-net)#657
Open
danieljohnmorris wants to merge 5 commits into
Open
feat(ILO-392): sub-world masking (read-only, net-only, no-net)#657danieljohnmorris wants to merge 5 commits into
danieljohnmorris wants to merge 5 commits into
Conversation
Collaborator
Author
|
needs manual rebase (conflicts in: src/verify.rs) |
Collaborator
Author
|
needs manual — rebase conflict in non-doc file(s) |
danieljohnmorris
force-pushed
the
feature/world-sub-masking
branch
2 times, most recently
from
5d7a889 to
5a1dcf5
Compare
danieljohnmorris
added
the
mac-reviewing
❌ 1 Tests Failed:
View the full list of 1 ❄️ flaky test(s)
To view more test analytics, go to the Test Analytics Dashboard |
danieljohnmorris
force-pushed
the
feature/world-sub-masking
branch
from
a6f5738 to
7465636
Compare
Add the `world` builtin and `W` type token so functions can declare
side-effect surfaces in their signatures (Zig/Zero capability-passing
pattern).
Changes:
- `Builtin::WorldCap` / `world` builtin: zero-arg, returns `Value::World`
constructed from the runtime's active `Caps` (CLI --allow-* flags)
- `Value::World { net, read, write, run: bool }` — opaque capability token
- `Token::WorldType` (`W`) — mirrors `L`, `R`, `M`, `O`, `S` tokens
- `parse_type_body`: `W` → `Type::Named("World")` (no new AST variant)
- `convert_type_with_aliases`: `Named("World")` → `Ty::World`
- `Ty::World` in verifier with field access (`.net/.read/.write/.run`)
all returning `Ty::Bool`; `compatible()` handles World↔Named("World")
- Parser: zero-arg call paths for `world` (mirrors `now`, `env-all`)
- VM: `NanVal::from_value(Value::World)` → heap record with 4 bool fields
- `examples/capability-world.ilo` — demo: pure fn, world-aware fn, main
- `tests/regression_world_builtin.rs` — 9 regression tests
- SPEC.md: `W` type in types table, new § Capability World, `world` builtin row
- ai.txt: `W` type entry in TYPES: block
Deferred (follow-ups): static enforcement at call sites, sub-world
masking (`w.read_only()`), multi-world composition, ILO-59 rebase.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…LO-T044
Add verifier-level static enforcement for the World capability system
introduced in ILO-68. When a net builtin is called in a scope that
contains a World statically known to deny net access, the verifier
rejects it at compile time.
Changes:
- `Builtin::WorldNoNet` / `world-no-net` zero-arg builtin: constructs
a `Value::World { net: false, ... }` with net denied; read/write/run
caps are inherited from the active CLI `Caps` policy
- `Ty::World { net_known: Option<bool> }`: extends the World type to
carry a statically-known net cap value (`None`=dynamic, `Some(false)`
=denied, `Some(true)`=future use); `world` returns `net_known: None`,
`world-no-net` returns `net_known: Some(false)`
- ILO-T044 verifier check: before type-checking any net builtin
(`get`, `pst`, `put`, `pat`, `del`, `hed`, `opt`, `getx`, `pstx`,
`get-many`, `get-to`, `pst-to`), scan scope for any variable of type
`World { net_known: Some(false) }` and emit ILO-T044 if found
- Parser: `world-no-net` registered as a zero-arg builtin in all three
zero-arg call sites (mirrors `world`, `env-all`, `rdin` precedent)
- Diagnostic registry: ILO-T044 entry with `--explain` text
- SPEC.md / ai.txt: capability-world section updated to document static
enforcement, `world-no-net`, and ILO-T044
- `tests/regression_world_static.rs`: 12 tests covering construction,
field access, enforcement (get/pst/put/del/hed), and valid patterns
(no denied World, dynamic World, W param)
- `examples/world-static-enforce.ilo`: end-to-end example
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add three World-deriving builtins for capability downscoping: - `read-only w:W > W` — net=false, write=false, run=false; read kept - `net-only w:W > W` — read=false, write=false, run=false; net kept - `no-net w:W > W` — net=false; read/write/run kept Extends ILO-T044 static enforcement (ILO-391) to fire for write builtins (wr/wra/wro/wrl) when a World with write_known=Some(false) is in scope, and for `run` when run_known=Some(false). 23 regression tests added. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
danieljohnmorris
force-pushed
the
feature/world-sub-masking
branch
from
7465636 to
834e962
Compare
Collaborator
Author
|
mac reviewing — CI watcher in flight on the latest force-push (effect_set fix) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
read-only w:W > W— strips net, write, run; keeps readnet-only w:W > W— strips read, write, run; keeps netno-net w:W > W— strips net only; read/write/run kept (takes existing World, unlike zero-argworld-no-net)Ty::Worldin the verifier to trackwrite_knownandrun_knownalongside the existingnet_knownwr/wra/wro/wrlcalls when awrite_known=Some(false)World is in scope, andruncalls whenrun_known=Some(false)tests/regression_world_sub_masking.rsExtends ILO-68 (#622) and ILO-391 (#652).
Test plan
cargo test --test regression_world_sub_masking— 23 tests passcargo test --test regression_world_static— 12 existing tests still passcargo test --test regression_world_builtin— 9 existing tests still passcargo build— clean compile, no errors🤖 Generated with Claude Code