Feature: Freeze provider WIT envelope ABI #148

Cohesive Capability

Edict has a versioned, runtime-neutral WIT contract for invoking provider-owned lowerer and verifier components with only explicit canonical inputs.

Testable Contract

• The contract uses the distinct package identity edict:target-provider@1.0.0; the previously shipped edict:target-profile@1.0.0 WIT remains an incompatible legacy fixture rather than being silently redefined.
• Lowerer input explicitly carries the { major, minor, patch } protocol version, canonical Core artifact and digest binding, target profile, resolved semantic artifacts, requested output roles, and deterministic response limits.
• Verifier input additionally carries the exact Target IR artifact.
• Inputs use role-aware digest-bound artifact records; providers receive no project paths or discovery handles.
• Lowerer and verifier use distinct output vocabularies, so lowerers cannot claim verifier reports and verifiers cannot claim Target IR or generated artifacts.
• Semantic inputs, requested outputs, and returned outputs use non-empty unique roles in strict ascending UTF-8 byte order. Diagnostics have one declared lexicographic order.
• Success returns exactly one output for every requested (role, kind, domain) and no undeclared outputs.
• Outputs carry role-tagged artifact bytes, optional logical package-relative paths, and structured diagnostics. Present paths are unique by exact case-sensitive UTF-8 bytes. Output artifacts carry no authoritative provider-supplied digest.
• Response limits apply to success and refusal. max-total-response-bytes is the checked aggregate of every provider-authored byte list and UTF-8 string in the selected result arm; overflow and exceeded bounds are host-owned failures.
• The canonical result is independent of limits. For otherwise identical requests, when it fits both limit sets, the entire selected result arm is byte-identical; providers cannot substitute, truncate, reorder, or change result arms to fit.
• Lowerer and verifier worlds expose one invocation function each and import exactly the protocol interface and required request/result types, with no ambient callable capabilities.

Required Evidence

• Parse the checked-in WIT with the official Bytecode Alliance wit-parser.
• Inspect the resolved WIT graph rather than matching prose.
• Assert the exact package members, scalar/container/payload types, records, variants, worlds, imports, functions, parameters, and results without treating independent declaration order as semantic.
• Parse the checked-in legacy fixture and prove its package and fine-grained RPC surface are incompatible with the replacement.
• Run the structural contract checks through cargo xtask verify and Rust 1.85.0.

Boundaries

• No component instantiation or Wasmtime dependency.
• No host-side semantic artifact decoding or output validation.
• No Echo-specific types or behavior.
• No deterministic replay execution.
• No runtime execution, admission, or registration.

Parent

Part of #141.