Merge pull request #385 from PhysShell/feat/ownir-v1-state-protocols

feat(ownir)!: OwnIR v1 (move, borrow_mut) + C# state protocols; T0 Amendment 1

Author: PhysShell

.github/workflows/ci.yml

@@ -3279,6 +3279,60 @@ jobs:
           fi
           echo "OK: Tier B A/B — external event OWN050 (no ref) -> OWN001 (with --ref-dir)"
 
+  # P-010 pillar 9, first slice: C# state protocols over OwnIR v1 (`move`,
+  # `borrow_mut`). The Layer 2/3 ledgers freeze the FACTS the Roslyn lowering emits,
+  # and both engines replay them with zero dotnet — which proves the engines agree
+  # on those documents and nothing about where the documents came from. This job is
+  # the other half: the real extractor over the real C#, so a frozen fact cannot
+  # drift away from the program it claims to describe.
+  #
+  # It also carries what no frozen fact can: programs the extractor must REFUSE
+  # (code with no contract inside a region, a protocol with a public mutator, a
+  # token made by hand in the protocol's own assembly), programs the C# compiler
+  # must reject, and an ASP.NET Core + EF Core backend driven over real HTTP against
+  # a real SQLite file — the transition has to reach the instance EF tracks and the
+  # row it saves, not merely type-check.
+  #
+  # Both platforms: the fixtures carry repo-relative `file` paths, and a path that
+  # is only right with one separator is the kind of thing a single runner hides.
+  state-protocols:
+    name: state protocols (C# -> OwnIR v1, real ASP.NET Core + EF Core backend)
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.13"
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
+        with:
+          dotnet-version: "8.0.x"
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master, 2026-07-10
+        with:
+          toolchain: stable
+      - name: Build own-cli (the second public engine)
+        if: matrix.os == 'ubuntu-latest'
+        working-directory: rust
+        run: cargo build -p own-cli
+      # One script, five questions; see its docstring.
+      - name: The protocol gate (cases, refusals, compiler rejections, one assembly, EF backend)
+        if: matrix.os != 'ubuntu-latest'
+        run: python scripts/protocol_gate.py
+      # On Linux it also compares the two PUBLIC CLIs on every C#-derived document:
+      # exit code, stdout and stderr, byte for byte. Linux only, for the reason
+      # #261 recorded: byte parity with the NATIVE-Windows Python reference is not
+      # claimed (it writes cp1252/CRLF), so that comparison would measure the
+      # console, not the engines.
+      - name: The protocol gate + both public CLIs on the C#-derived documents
+        if: matrix.os == 'ubuntu-latest'
+        run: python scripts/protocol_gate.py --rust "$PWD/rust/target/debug/own-cli"
+
   # P-012 slice 1: score the checker against the labeled corpus on REAL C# — not
   # just the .own reduction tests/test_corpus.py checks. Per case: the bug must be
   # CAUGHT in before.cs (recall) and the fix must be SILENT in after.cs

audit/static/run_static.py

@@ -363,7 +363,7 @@ def check(ok: bool, msg: str) -> None:  # total derives from the call count
 
     def _fake_own_check(target_, out_dir_, severity_, root=None):
         facts = Path(out_dir_) / "own-check.facts.json"
-        facts.write_text(json.dumps({"ownir_version": 0, "module": "App", "components": [
+        facts.write_text(json.dumps({"ownir_version": 1, "module": "App", "components": [
             {"name": "CustomerView", "file": "Views/CustomerView.xaml.cs", "subscriptions": [
                 {"event": "_bus.Changed", "handler": "OnChanged", "line": 21,
                  "released": False}]}]}), encoding="utf-8")
@@ -419,7 +419,7 @@ def _fake_own_check(target_, out_dir_, severity_, root=None):
             '             x:Class="App.Views.CustomerView" Loaded="OnLoaded" />\n',
             encoding="utf-8")
         (out5 / "own-check.facts.json").write_text(json.dumps({
-            "ownir_version": 0, "module": "Stale", "components": [
+            "ownir_version": 1, "module": "Stale", "components": [
                 {"name": "CustomerView", "file": "Views/CustomerView.xaml.cs",
                  "subscriptions": [{"event": "_bus.Changed", "handler": "OnChanged",
                                     "line": 21, "released": False}]}]}), encoding="utf-8")

audit/static/tools/xaml_join.py

@@ -303,7 +303,7 @@ def check(ok: bool, msg: str) -> None:
          "event_handlers": [{"event": "Loaded", "handler": "OnLoaded", "line": 4}],
          "bindings": [], "named_elements": []},
     ]}
-    ownir = {"ownir_version": 0, "module": "App", "components": [
+    ownir = {"ownir_version": 1, "module": "App", "components": [
         {"name": "CustomerView", "file": "Views/CustomerView.xaml.cs", "subscriptions": [
             {"event": "_bus.Changed", "handler": "OnChanged", "line": 21, "released": False}]},
         {"name": "CleanView", "file": "Views/CleanView.xaml.cs", "subscriptions": [
@@ -363,7 +363,7 @@ def check(ok: bool, msg: str) -> None:
     wrong_ns = {"documents": [{"file": "Features/Billing/CustomerView.xaml",
                 "x_class": "Billing.CustomerView",
                 "event_handlers": [{"event": "Loaded", "handler": "OnLoaded", "line": 4}]}]}
-    other = {"ownir_version": 0, "components": [
+    other = {"ownir_version": 1, "components": [
         {"name": "CustomerView", "file": "Legacy/CustomerView.cs", "subscriptions": [
             {"event": "_bus.Changed", "handler": "OnChanged", "line": 9, "released": False}]}]}
     check(join(wrong_ns, other) == [],

corpus/ownership-lab/h29/door/neg-family.facts.json

@@ -1 +1 @@
-{"ownir_version": 0, "module": "M", "orphaned_awaitables": [{"local": "tx", "callee": "T.M/0", "file": "Q.cs", "line": 1, "family": "C_whatever"}]}
+{"ownir_version": 1, "module": "M", "orphaned_awaitables": [{"local": "tx", "callee": "T.M/0", "file": "Q.cs", "line": 1, "family": "C_whatever"}]}

corpus/ownership-lab/h29/door/neg-garbage.facts.json

@@ -1 +1 @@
-{"ownir_version": 0, "module": "M", "orphaned_awaitables": [{"local": ["what", "is", "this"], "callee": {"oops": 1}, "file": "Q.cs", "line": 119, "result_type": 12345}]}
+{"ownir_version": 1, "module": "M", "orphaned_awaitables": [{"local": ["what", "is", "this"], "callee": {"oops": 1}, "file": "Q.cs", "line": 119, "result_type": 12345}]}

corpus/ownership-lab/h29/door/neg-line_above.facts.json

@@ -1 +1 @@
-{"ownir_version": 0, "module": "M", "orphaned_awaitables": [{"local": "tx", "callee": "T.M/0", "file": "Q.cs", "line": 2147483648}]}
+{"ownir_version": 1, "module": "M", "orphaned_awaitables": [{"local": "tx", "callee": "T.M/0", "file": "Q.cs", "line": 2147483648}]}

corpus/ownership-lab/h29/promotion/promo-u.facts.json

@@ -1,5 +1,5 @@
 {
-  "ownir_version": 0,
+  "ownir_version": 1,
   "module": "Extracted",
   "components": [],
   "services": [],

docs/ROADMAP.md

@@ -318,7 +318,7 @@ own scan. Label them as estimates wherever they appear.
 | [P-007](proposals/P-007-arraypool-span.md) | ArrayPool / Span borrow-view | P1 | in progress (POOL001–003 built; 004/005 first slices) |
 | [P-008](proposals/P-008-effects-and-resources.md) | Effects & resources (`Own.Effects`) | P1/P2 | draft |
 | [P-009](proposals/P-009-nogc-regions.md) | No-GC / allocation-free regions | horizon | draft |
-| [P-010](proposals/P-010-type-disciplines.md) | Richer type disciplines (`Own.Types`) | P2/horizon | draft |
+| [P-010](proposals/P-010-type-disciplines.md) | Richer type disciplines (`Own.Types`) | P2/horizon | draft; pillar 9 first slice built |
 | [P-011](proposals/P-011-editor-tooling.md) | Editor tooling & syntax highlighting | side-track | draft |
 | [P-012](proposals/P-012-bug-corpus-mining.md) | Real-world bug corpus & mining | enabling | in progress (corpus benchmark + real-world cases, CI-gated) |
 | [P-013](proposals/P-013-distribution-surface.md) | Distribution surface (CI Action + dotnet tool) | enabling | v0 built |

docs/evidence/calibration/p022-263a-design-constants.json

@@ -1,6 +1,6 @@
 {
   "artifact": "p022-263a-calibration-design-constants",
-  "bound_measurement_harness_digest": "104c384d01bf6060bdec1e7c916053ddb04b97fcbd0b39f8a4fc57b8f139672f",
+  "bound_measurement_harness_digest": "1a26aa63fd5fbbe06e7ae72dd5e1c8f2d611bff8856af4a5b93ae36d2d23a9b1",
   "bound_policy_implementation_digest": "c3068ed7fa880a7083866ead25fe8bf65c87889d242d8af1f7eee01582cd5cbf",
   "constants": {
     "G": [

docs/evidence/calibration/p022-263a-policy-freeze.json

@@ -1,6 +1,6 @@
 {
   "artifact": "p022-263a-calibration-policy-freeze",
-  "measurement_harness_digest": "104c384d01bf6060bdec1e7c916053ddb04b97fcbd0b39f8a4fc57b8f139672f",
+  "measurement_harness_digest": "1a26aa63fd5fbbe06e7ae72dd5e1c8f2d611bff8856af4a5b93ae36d2d23a9b1",
   "policy_implementation_digest": "c3068ed7fa880a7083866ead25fe8bf65c87889d242d8af1f7eee01582cd5cbf",
   "policy_implementation_digest_framing": "sha256 over the source set ordered by the UTF-8 bytes of each repo-relative POSIX path. Each file contributes, with no header and no separator: its path byte length as an 8-byte big-endian unsigned integer, its path's exact UTF-8 bytes, its blob byte length as an 8-byte big-endian unsigned integer, and its exact git blob bytes.",
   "policy_source_commit": "b4f657a0abdfdfaae199cbc7eee0c47acd8b0057",