Skip to main content

Core original staged archive and qualified namespace: NQ1 proposal

Status: Development SOURCE ONLY; proposed interface/dependency decision under #1643, SPEC-002 AC-4CF.1b, SPEC-006 AC-6E.SA1, CA03/CA04/CA06. NQ1 is not selected architecture, product implementation, SOURCE GO, executable admission, source approval, qualification or runtime activation. It must receive different complete architecture review before its material native interfaces/dependencies are implemented. Accepted CE1 remains unchanged.

Concrete source discrepancy​

The frozen whole Core source already has NativeStageRead, NativeStageReadObservation, NativeCapsuleNamespace, NativeCapsuleApproval, readOriginalNativeCapsule, NativeCapsuleStorage, OriginalInputObjectRead, Budget and Deadline. The staged reader supplies genuine original read buffers, object identity and an actual zero-byte EOF. The capsule reader verifies exact framing, original hashes and a supplied approval list. It does not construct that list by validating original catalog/policy/baseline/authored bytes. In particular authoredBytes bypasses the baseline length/hash comparison; it is not authoring permission or a semantic validation result.

The actual TS owner remains catalog.ts, canonical-policy.ts, zip.ts, strict-json.ts, digests.ts, controller.ts and the complete 2475-line discovery/validateManifest.ts. Blueprint native profile paragraph 21, stage paragraph 25 and capsule paragraph 29 are interpreted with their whole sections, SourceSafe and ADR, never standalone numbered permissions. Core performs original actor authorization and canonical semantics; native storage independently verifies the capsule/catalog/stage correspondence before effects. NQ1 adds a complete native repetition of those semantics without moving actor authorization or source approval to a parser.

No native inflater, ECMAScript Unicode regular-expression implementation, insertion-order JSON tree, native whole manifest validation implementation, or authentic catalog authority wrapper exists in those frozen source interfaces. Existing Json uses std::map, retains number lexemes and performs sorted compact serialization. It cannot substitute for JSON.stringify(value, null, 2) plus LF, Number conversion or ECMAScript property ordering. Existing OriginalInputObjectRead explicitly implements only transferred original IO; its constructor cannot confer CE1 source-owner/publication admission. Production TS catalog is empty. NQ1 must keep that genuine denial and implement a complete route for independently admitted inputs.

Proposed native operation boundary​

NQ1-R1 removes the earlier angle-bracket signature: no positive qualifyOriginalNativeStage signature can currently name an implemented authentic catalog acquisition type. The R1 counterevidence and concrete decision distinguishes existing original IO data from the absent CE1 owner/source-realm producer and packet admission. A parser data argument is not an admitted type. Positive factory implementation stays NO_GO until the actual producer/consumer/type and retained original authority are implemented and independently reviewed under primary constructor ownership.

The genuine catalog acquisition must expose its original independently admitted owner/source/publication association and complete immutable catalog row, plus the four original OriginalInputObjectRead leases in fixed order: archive, descriptor, policy, sums. The parser borrows them and checks their actual length/hash/native identity and genuine EOF. A metadata view is correlation only. No public/profile field, ordinary native operation, initialization, enroll action, source signer, new actor or permission is added. Source authority and provider/key lineage remain separate. The selected realm must provide the existing original association; NQ1 does not invent a lease or fill an absent realm with success.

The factory returns a move-only QualifiedNamespace with:

  • const NativeCapsuleNamespace& capsuleNamespace() const;
  • const Binding& binding() const;
  • immutable ordered entry views whose bytes borrow retained native owner allocations, with exact path/final mode/count/SHA;
  • actual original stage read observations including the genuine EOF buffer and original object/digest association;
  • original four-asset read/EOF associations and charged parser/inflater/semantic dependency observations for the existing observer to correlate;
  • explicit unresolved/ended ownership state for the engine's existing receipt/close path.

There is no public constructor accepting validated booleans or a caller-supplied approval vector. Only the complete operation can make a result after every predicate passes. capsuleNamespace().entries contains the exact accepted byte length/hash for EVERY entry and uses authoredBytes=false for EVERY entry. Thus existing capsule hash validation compares actual authored bytes as strictly as immutable bytes. Final modes come only from validated owner inventory; provenance is 0644. The wrapper provides no readReceipt, observer proof, Audit receipt, durable:true, provider signature, catalog approval or source qualification.

The result must keep the original physical byte leases and the authentically borrowed source association valid through actual capsule construction, seal/readback, acceptance and observer correlation. Const access cannot hide an external mutable allocation. No fresh path reopen supplies bytes. A naked pointer/span is valid only during its retained owning lifetime. Before emission and after native seal the engine independently correlates original object/source association and exact binding; any mismatch preserves denial/unresolved ownership. The primary owner integrates this into original stage/preflight/capsule effects. A dormant header cannot complete those effects.

Compression implementation selection​

Proposed new internal headers implement a native RFC1951 decoder, CRC32, strict gzip wrapper and the complete SLTP ZIP profile. This is a source-owned decoder, with no external library, Node callback or OS subprocess. It has no schema or public interface authority. Its implementation and adversarial cases receive independent whole review. The operation takes immutable compressed views and writes directly into its exact pre-reserved native output allocation, retaining input owners. Stored, fixed-Huffman and dynamic-Huffman blocks all work, including empty blocks/empty output, bit crossings, overlapping distance copies and complete legal code alphabets. Invalid oversubscribed/impossible alphabets, missing end codes, illegal repeats, impossible distances, reserved block/type/code values, truncation, overrun and incomplete termination deny. Exact input consumption is observed, not inferred from output length. CPU progress is checked against the same original deadline without renewal.

Gzip accepts actual TS optional FEXTRA/FNAME/FCOMMENT/FHCRC handling, validates reserved flags and method8, validates header CRC when present, exact single deflate stream consumption, CRC32 and ISIZE, and exactly one final trailer at original EOF. Concatenated streams/trailing bytes deny because the current canonical asset decoder requires the trailer to end the complete asset. TAR independently implements the actual canonical assets profile: checksums/octal/strict UTF8 zero-terminated fields, the allowed first exact commit PAX global record, complete expected directory set, original allowed file set including policy self-member, original mode transformation, length/hash/policy equality, zero padding and at least two zero blocks with wholly zero tail aligned to512. No extraction occurs.

SLTP ZIP implements EVERY predicate of decodeAdmissionZip: final22-byte EOCD only, no comment/split disk; exact counts/central boundaries/declared inventory; needed<=20; flags exactly0800; methods0/8; no extra/comment/disk; exact regular100644 attributes and no directory bit; identical local/central name, method, flags, sizes, CRC; no holes/overlap/prefix/trailing local records; exact whole compressed input consumption; raw expanded count and CRC; expected path membership and duplicates. Transport mode is always0644; owner final0755 remains a separate materialization property. All existing tighter owner bounds apply: compressed<=10MiB, entries<=512 and actual maximumFiles, each entry<=8MiB, full expanded<=64MiB and actual maximumTotalBytes, ratio<=100, path depth from actual policy. Integer additions use checked wide arithmetic before range access. Empty stored/deflated files remain supported.

Ordered JSON, Number and regular-expression dependency decision​

Proposed ordered JSON implementation is a native port of the exact strict reader and serializers, separate from the journal's existing Json. Object member order is retained, decoded duplicate keys deny, UTF8/surrogate/BOM/trailing/depth/token/member/string-byte bounds remain exactly the current TS contracts. Value construction and scalar conversion are charged. Numbers are binary64 finite values with the same decimal input conversion and ECMAScript shortest-roundtrip output, including negative-zero normalization, exponent formatting and property index ordering. Pretty serialization uses two spaces, empty object/array handling and one LF, with ECMAScript integer-index keys first and insertion order for other keys. Contract canonical hashing reproduces canonicalJson's UTF16 lexicographic key sort followed by ECMAScript enumeration, excludes only contractDigest, and excludes final LF for the semantic digest. Raw pretty equality cannot be replaced with sorted JSON equality or a lexeme-preserving number printer.

The unresolved material dependency is the complete native ECMAScript RegExp semantics required by actual policy strings with flags u, iu, imu, and unflagged compilation in outputvarregex. std::regex, RE2, a small handwritten pattern subset, ASCII folding, a hardcoded current policy pattern list or a Node semantic callback cannot establish equivalence or retain all valid inputs. NQ1 proposes a source-owned native port of the exact RegExp syntax/matching/Unicode semantics of the frozen Core runtime contract, using charged allocation and interrupt checks at the original deadline. The exact reference engine source/Unicode version and finite allocator hooks must be selected and frozen BEFORE implementation. No guessed engine pin is selected here. The review must resolve whether a complete port is feasible under this ownership domain or select a concrete fully source-pinned native engine with equivalent semantics and complete allocator/dependency custody. That alternative requires an amended complete NQ1 packet, not a silent dependency installation.

This dependency decision is concrete and source-level: full language semantics, exact source/Unicode reference, all allocators and original-deadline interruption are required together. Actual implementation must retain backreferences/lookarounds/capture/Unicode escapes/property escapes/casefold/multiline/zero-width/greedy behavior wherever the selected Core contract accepts them. A source/engine version mismatch or unproved valid-input exclusion keeps NQ1 unselected. No max-pattern restriction, regex instruction counter or hidden replacement timeout is introduced. The existing original end remains authoritative.

Complete canonical and authored semantic operation​

First validate the complete source catalog exactly as validateCatalogEntry, including all four names/caps/hash syntax, template tuple/tag/profile/version, inventory mode/size/hash/order, manifest presence/config membership, policy+provenance namespace and original approval/source references. Shape/hash checks are not source authority. Independently read and verify all four assets; validate descriptor closed8 and policy closed7 keys and every nested row/rule/quota/provenance shape. Verify raw pretty bytes, policy SHA and unsigned semantic contract digest, exact SHA256SUMS bytes and complete TAR baseline. Do not make75/84 a cap or fabricate a nonempty catalog.

Then consume the already-held original staged reader sequentially at <=65536 per native request through actual EOF. Check original object/count/archiveSHA against original Declaration, retaining actual observations. Decode complete ZIP under source policy. Validate complete path namespace, expected baseline+generated provenance set and all owner bounds. Parse original/candidate manifest and provenance with actual per-role strict JSON limits and compare exact pretty bytes. Apply the complete original validateServiceManifest validation predicate, including all healthcheck, materialization, env, outputvarregex, log, stdin, hook, monitoring/restart/doctor, setup dependency/path, files/isolation, endpoints, actions/payload/schedules, broker uniqueness/access/writeback/collision, artifact/update and execservice dependencies. It must preserve current permissive/ignored properties as well as current explicit rejection; it cannot replace the general validator with a closed top-level schema.

Apply exact owner editable pointer rules recursively; every immutable key/container/value remains unchanged. developers stays closed name-only, tags typed/bounded, enabled boolean, strings bounded and matched under actual owner regex. Provenance is closed6 plus exact local-archive or github-derived origin, pinned tuple and catalog archiveSHA/repository syntax; derived repository URL is exactly the matching approved URL, local origin retains the accepted original. Config only actual allowed paths, strict UTF8, aggregate bytes and complete forbidden-name/value patterns. All other baseline bytes including policy are exact. Validate declared serviceID/version/manifest SHA and compute normalized staged/materialization/candidate digests from the complete sorted inventory with the original digest domains/record encoding.

Capsule emission uses those exact retained accepted entries in <=65536 chunks; no full64MiB frame allocation and no copied67MiB envelope. Native seal must repeat original correspondence and all existing MAC/provider/journal/native-storage checks; no key moves to this parser. Parent whole consumer integration remains obligatory.

Same finite owner and failure state​

All original reads, compressed leases, expanded immutable bytes, parser trees/strings/nodes, sorting/path metadata, decoder tables/window/state, regex programs/matches, controls and native observer associations consume the SAME original finite128MiB owner. Budget source counters are not actual allocator qualification. NQ1 requires original physically tracked allocator observations and complete ended borrower/control proof; a vector destructor, GC or returned local counter is not FREE.

For generic native64MiB inventory capacity, allocate expanded entry bytes once and share immutable views across hashing and capsule emission. This capacity case cannot be a current owner-authorized authored semantic positive: current canonical archive/ratio/baseline/editable quotas impose tighter bounds, as R1 calculates. Preserve at most one original staged compressed backing set, bounded canonical baseline from actual<=524288 TAR quota, bounded JSON and metadata/inflater working storage; no second64MiB inventory/capsule envelope. Original read borrowers may overlap a compressed set only while their actual owner is retained; account maximum backing allocation, not logical length. Compaction or relinquishment requires actual physical end evidence. Owner ceiling must not be increased and valid original-domain inputs must not be blanket-denied because of a duplicate implementation allocation. Complete RegExp physical occupancy remains unproved; the R1 dependency/allocation map is counterevidence, not a fabricated128MiB success bound.

Operation state is acquiring/reading/parsing/qualified or unresolved; only genuine observer/native-end associations permit ended. A failed constructor/parser/inflate/deadline/read/hash/identity/source correlation retains an engine-owned failure carrier BEFORE an owner can be destroyed. It holds original observations and every unresolved allocation/source lease. No success-qualified result escapes; no synthesized EOF, close receipt, throw-and-forget reservation release or destructive cleanup. Engine retains original stage/read resources for existing release/read-receipt path. Recovery does not infer proof from an enum, a charge or a file name.

Selection, implementation and rollback​

Different entire review must select the exact authentic catalog acquisition boundary, native compression code route, ordered JSON/Number semantics, exact full RegExp source/Unicode/allocator route and complete manifest predicate before positive product implementation. The whole candidate includes original frozen dependencies, actual primary caller/constructor ownership and all prospective vectors, not just this new document. Any rejected alternative stays recorded. No header-only or parser-only result is whole Core completion.

After selection, implement new headers without overwriting frozen/native engine/binding/constructor source owned by the primary author; add meaningful real-parser regressions. Freeze/push the complete bounded source, obtain different entire source review, integrate into the actual whole consumer under primary custody, obtain final different whole SOURCE GO and NEW authentic complete-input ROOT before imports/parser/compiler/build/tests/Node/npm/native/ACL/ENV execution. Existing source authority/resources absence, release/TUI/Core ZIP/published/native journeys and original failures remain separate. Rollback leaves native admission unavailable and retains originals/unknowns; no fallback parser, catalog enrollment, provider mutation or cleanup follows.

NQ1 remains a proposed decision until the RegExp source/dependency and genuine importer interface are concretely reconciled. The open questions are executable implementation dependencies, not a request to provision a runtime or weaken the accepted contract.