Add bounded node-atom reads and ordered guards

.ban-nondeterminism-allowlist

@@ -35,3 +35,5 @@ std-fs crates/warp-core/tests/wsc_store_tests.rs WSC filesystem fixture I/O only
 std-process crates/warp-core/tests/wsc_store_tests.rs WSC filesystem fixture temp directory disambiguation only.
 std-fs crates/warp-math/tests/trig_golden_vectors.rs golden-vector fixture read/write only.
 std-fs crates/echo-edict-provider-lowerer/tests/lowerer_contract.rs explicit ignored checked generated-helper fixture regeneration only.
+std-env crates/warp-core/tests/edict_node_read_tests.rs test-only selection of public-compiler fixture directory; fixed independently recorded package pins remain mandatory and no semantic runtime environment is read.
+std-fs crates/warp-core/tests/edict_node_read_tests.rs test-only loading of unchanged public-compiler CBOR fixtures; evaluation always checks fixed package pins; separate witnesses check the retained accepted reports.

.github/workflows/ci.yml

@@ -151,7 +151,7 @@ jobs:
                   cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test --test executable_operation_pipeline_tests -- -D warnings -D missing_docs
 
             - name: cargo clippy (compiler-produced pure evaluation)
-              run: cargo clippy -p warp-core --features trusted_runtime --lib --test edict_pure_evaluation_tests --test edict_pure_unsigned_subtraction_tests --test edict_pure_byte_length_tests --test edict_byte_equality_tests -- -D warnings -D missing_docs
+              run: cargo clippy -p warp-core --features trusted_runtime --lib --test edict_pure_evaluation_tests --test edict_pure_unsigned_subtraction_tests --test edict_pure_byte_length_tests --test edict_byte_equality_tests --test edict_node_read_tests -- -D warnings -D missing_docs
 
     clippy-det-fixed:
         name: Clippy (det_fixed)
@@ -314,7 +314,7 @@ jobs:
                   cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test --test executable_operation_pipeline_tests
             - name: cargo test (compiler-produced pure evaluation)
               run: |
-                  cargo test -p warp-core --features trusted_runtime --test edict_pure_evaluation_tests --test edict_pure_unsigned_subtraction_tests --test edict_pure_byte_length_tests --test edict_byte_equality_tests
+                  cargo test -p warp-core --features trusted_runtime --test edict_pure_evaluation_tests --test edict_pure_unsigned_subtraction_tests --test edict_pure_byte_length_tests --test edict_byte_equality_tests --test edict_node_read_tests
                   cargo test -p warp-core --features trusted_runtime --lib edict_pure::
             - name: cargo test --doc (warp-core)
               run: cargo test -p warp-core --doc

CHANGELOG.md

@@ -7,6 +7,37 @@
 
 ### Fixed
 
+- `ReadView::at` validates the aperture and derives the selected current frontier
+  basis with one state hash. `ReadView::new` still checks an independently
+  selected expected basis. Both retain the same aperture and trust boundaries.
+
+- Public bounded-read compiler timeouts retain partial stdout/stderr and the
+  original timeout as the failure cause.
+
+- Bounded-read lowering recognizes only the exact unsigned primitive coordinates.
+  Named structural types starting with `U` now reach ordinary type lookup, as
+  they already do in independent verification and runtime parsing.
+
+- Private read evaluation identifies the input by its verified `arg.0` identity.
+  Reordering a package's local declarations no longer changes input selection.
+
+- Read-provider lawpack validation remains separate from the pure profile's
+  empty-effect requirement, preserving read acceptance and pure-effect refusal
+  after integration of the strengthened pure-provider checks.
+
+- The bounded-read public compiler witness preserves return status and raw
+  streams when malformed or non-object JSONL prevents structured validation.
+
+- Bounded-read evaluator tests now require `trusted_runtime` in Cargo and run
+  in feature-enabled CI and opt-in local routes, including shared parser edits.
+
+- Removed the bounded-read witness's unguarded image/entrypoint recipe. Public
+  compiler and fresh-output runtime witnesses require a continuously guarded
+  reusable worker; pre/post measurements alone are not budget enforcement.
+
+- Generated provider helpers bind the bounded-read schema publication, including
+  its exact schema identity in the helper contract and derivation materials.
+
 - Byte-equality fixture reproduction guidance now requires guarded reusable
   compiler storage and preserves the limits of its frozen provider evidence.
 
@@ -58,6 +89,28 @@
 
 ### Added
 
+- Trusted-host private evaluation of pinned bounded-read packages over an
+  immutable frontier and explicit node aperture. Reads and ordered guards
+  enforce typed obstructions and intersected host/package budgets without
+  mutating the frontier. Full-state view preparation is outside the interpreted
+  budget; this API produces no causal admission, receipt, or WAL evidence.
+
+- The native provider lowerer has an explicit `compiler-produced-bounded-read/v1`
+  configuration for opaque node-atom reads and ordered byte guards. It checks
+  the imported signature, local scope, failure mappings, and Core/Target order,
+  and retains the exact semantic artifacts in its output package. This profile
+  is published in the checked schema/components and compiles through the
+  explicit ordered-contract package. Runtime evaluation remains separate.
+
+- The native read-package verifier independently reconstructs Core instructions
+  from ordered Target IR and checks signatures, local scope, obstructions,
+  projection, budgets, and exact embedded artifacts. Accepted and rejected
+  reports bind the exact package, target, and projection. Both native read
+  paths include output metadata and diagnostics in their response-byte limits.
+  Public Edict builds accept single and independent-address paired reads with
+  the promoted lowerer/verifier components; repeated builds reproduce the exact
+  package/report pair. Existing frozen consumer pins remain unchanged.
+
 - The package-pinned pure evaluator now supports equality of bounded byte
   values, including nominal IDs. It charges the larger operand's byte length
   before comparing, independent of mismatch position. Byte ordering and mixed

crates/echo-edict-provider-lowerer/README.md

@@ -35,9 +35,30 @@ post-effect scope by their complete identities before cloning expressions into
 Target IR. It accepts only an empty input-constraint set and the reviewed
 zero-argument `domain.WriteRejected` obstruction constructor. Effect inputs and
 intent results admit no call-expression callee in this closure; later
-constraint, constructor, or call semantics require explicit lowering laws. Reads remain
-unsupported and fail closed; the lowerer never represents a read as a synthetic
-mutation.
+constraint, constructor, or call semantics require explicit lowering laws. Reads
+remain unsupported in that checked compatibility closure; the lowerer never
+represents a read as a synthetic mutation.
+
+The native Rust source separately supports the opt-in
+`compiler-produced-bounded-read/v1` configuration, including explicit `maxReads`
+and `maxReadBytes` bounds. It lowers opaque node-atom reads with source-ordered
+guards, validates imported signatures and failure mappings, rejects unavailable
+locals and altered instruction order, and retains every semantic artifact needed
+by subsequent verification and interpretation. The supported expressions are
+locals, record construction/selection, byte equality, and unsigned equality or
+ordering guards. Failure arms currently require zero-argument application
+obstruction constructors; terminal guards require an empty obstruction payload.
+
+The checked schema and component now publish this read configuration. Selecting
+the ordered contract publication lets unmodified Edict compile the authored
+single and independent-address paired reads through this component and the
+independent verifier. The original native fixtures retain their diagnostic
+capture provenance; the separate public compiler witness proves package/report
+publication without instrumentation. A separate trusted-host private evaluator
+consumes pinned packages over real frontier storage; its authority and evidence
+limits are documented in
+[application contract hosting](../../docs/architecture/application-contract-hosting.md).
+Emitting a package grants no observation or execution authority.
 
 The same component now exposes a separate generic executable-operation route.
 When Edict requests `executable-operation-package.echo`, the lowerer consumes
@@ -117,8 +138,8 @@ proposal constructor supports mutations and refuses a `Query`; authored reads
 remain a separate bounded observer/optic path and must never be represented as
 synthetic mutations.
 
-The refreshed 279,564-byte checked lowerer component has SHA-256
-`11244b22dcf7128489953f7a2d09df1eeb69e7b25bddb54e0e255b51ca23e016` and has
+The refreshed 381,459-byte checked lowerer component has SHA-256
+`4b594a8165079f0a973741b9e27b468cf041f4ad53108fccae641dc35355bd2a` and has
 crossed the reproducible promotion boundary. The pinned Edict host admits its
 generated envelope under the owning `generated-artifact` CDDL root, and the
 isolated host fixture exercises the exact helper binding, typed codecs, EINT

crates/echo-edict-provider-lowerer/src/executable_operation.rs

@@ -2,6 +2,8 @@
 // © James Ross Ω FLYING•ROBOTS <https://github.com/flyingrobots>
 //! Generic data-only lowering into Echo's bounded executable-operation profile.
 
+mod bounded_read;
+
 use std::collections::BTreeSet;
 
 use blake3::Hasher;
@@ -128,6 +130,10 @@ pub(super) fn lower(request: &LoweringRequestV1) -> Result<LoweringSuccessV1, Pr
     let target_ir = validate_bound(&closure.target_ir.artifact, TARGET_IR_DOMAIN)?;
     let source = validate_source(&source, closure.source, &request.core)?;
 
+    if bounded_read::is_configuration(&configuration) {
+        return bounded_read::lower(request, &closure);
+    }
+
     if is_pure_configuration(&configuration) {
         return lower_compiler_produced_pure(
             request,
@@ -299,6 +305,35 @@ fn validate_pure_lawpack(
     closure: &ClosureInputs<'_>,
     target_profile: &BoundArtifact,
     intent: &CanonicalValueV1,
+) -> Result<(), ProviderRefusalV1> {
+    validate_compiler_lawpack(
+        value,
+        exports_value,
+        adapter_value,
+        closure,
+        target_profile,
+        intent,
+    )?;
+    let profiles = required_map(
+        adapter_value,
+        "operationProfiles",
+        "adapter.echo-pure-operation",
+    )?;
+    let (_, profile) = single_text_map_entry(profiles)
+        .ok_or_else(|| super::unsupported_semantics("adapter.echo-pure-operation"))?;
+    if !required_array(profile, "semanticEffects", "adapter.echo-pure-operation")?.is_empty() {
+        return Err(super::unsupported_semantics("adapter.echo-pure-operation"));
+    }
+    Ok(())
+}
+
+fn validate_compiler_lawpack(
+    value: &CanonicalValueV1,
+    exports_value: &CanonicalValueV1,
+    adapter_value: &CanonicalValueV1,
+    closure: &ClosureInputs<'_>,
+    target_profile: &BoundArtifact,
+    intent: &CanonicalValueV1,
 ) -> Result<(), ProviderRefusalV1> {
     let id = required_text(value, "id", "lawpack.echo-pure-operation")?;
     let version = required_text(value, "version", "lawpack.echo-pure-operation")?;
@@ -346,9 +381,6 @@ fn validate_pure_lawpack(
     if text_field(profile, "core") != text_field(intent, "requiredOperationProfile") {
         return Err(super::unsupported_semantics("adapter.echo-pure-operation"));
     }
-    if !required_array(profile, "semanticEffects", "adapter.echo-pure-operation")?.is_empty() {
-        return Err(super::unsupported_semantics("adapter.echo-pure-operation"));
-    }
     required_nonempty_text(profile, "budgetObligation", "adapter.echo-pure-operation")?;
     require_resource_ref(
         required_map(
@@ -600,6 +632,36 @@ fn encode_pure_package(
     ]);
     let program = encode_canonical_cbor_v1(&program)
         .map_err(|_| invalid_artifact(PACKAGE_ROLE, "pure program could not be encoded"))?;
+    encode_compiler_package(
+        request,
+        closure,
+        intent,
+        operation_coordinate,
+        program,
+        CompilerPackageProfile {
+            kind: PURE_PROGRAM_KIND,
+            authority: PURE_AUTHORITY_PROFILE,
+            footprint: PURE_FOOTPRINT_CONTRACT,
+            interpreter: PURE_INTERPRETER_PROFILE,
+        },
+    )
+}
+
+struct CompilerPackageProfile {
+    kind: &'static str,
+    authority: &'static str,
+    footprint: &'static str,
+    interpreter: &'static str,
+}
+
+fn encode_compiler_package(
+    request: &LoweringRequestV1,
+    closure: &ClosureInputs<'_>,
+    intent: &CanonicalValueV1,
+    operation_coordinate: &str,
+    program: Vec<u8>,
+    profile: CompilerPackageProfile,
+) -> Result<Vec<u8>, ProviderRefusalV1> {
     let core_identity = hash_from_bound(&request.core)?;
     let budget = required_map(intent, "coreEvaluationBudget", operation_coordinate)?;
     let semantic_closure = canonical_map([
@@ -633,7 +695,7 @@ fn encode_pure_package(
     let package = canonical_map([
         (
             "authority_profile_identity",
-            hash_value(profile_digest(PURE_AUTHORITY_PROFILE)),
+            hash_value(profile_digest(profile.authority)),
         ),
         (
             "budget_ceiling",
@@ -660,14 +722,14 @@ fn encode_pure_package(
         ),
         (
             "footprint_contract_identity",
-            hash_value(profile_digest(PURE_FOOTPRINT_CONTRACT)),
+            hash_value(profile_digest(profile.footprint)),
         ),
         (
             "interpreter_profile_identity",
-            hash_value(profile_digest(PURE_INTERPRETER_PROFILE)),
+            hash_value(profile_digest(profile.interpreter)),
         ),
         ("operation_coordinate", canonical_text(operation_coordinate)),
-        ("package_kind", canonical_text(PURE_PROGRAM_KIND)),
+        ("package_kind", canonical_text(profile.kind)),
         ("program", CanonicalValueV1::Bytes(program)),
         ("schema", canonical_text(PACKAGE_SCHEMA)),
         ("semantic_closure", semantic_closure),