Adapter purity permits declared code and execution placement (D-052)

Supersedes D-026's universal ban on adapter placement and rung-walking.
Adapters are where program code meets the LM; formats can carry
executable code. Purity means declared transformations without hidden
LM calls or effects, not absence of code or placement. Executable
entries declare code identity, dependencies, language, execution
requirements, and placement needs; hosts supply compatible bindings or
refuse loudly; the typed transformation interface stays invariant
across local, sandboxed, and remote placement.

Preserved: single-shot (PIR-008), credential names never values
(PIR-005), identity vs location (PIR-010), receiver binding before
sidecar, isolation floors, and the data-only declared-tier profile
(DT-002/DT-003). No schema, fixture, or executor change; the byte shape
and binding ABI are follow-up gates named in the changes entry.

Touches spec/placement.md, spec/invariants.md (PIR-012), spec/errors.md
(LANG/PROFILE), spec/manifest.md (component 4);
changes/2026-09-07-adapter-code-placement.md records authority, scope,
and gates. Source sync: dspy roadmap D-052.

Author: MaximeRivest

changes/2026-09-07-adapter-code-placement.md

@@ -0,0 +1,98 @@
+# Adapter purity permits declared code and execution placement
+
+**Recorded:** 2026-09-07. This is the amendment record date, not a separately
+verified approval date.
+
+**Authority:** Maxime ratified the principle below in session on 2026-09-07,
+while designing LMCC's host-supplied format executor: amend ProgramIR rather
+than design LMCC around its old restriction. The ratification covers the
+principle, not a specific ABI or backend.
+
+**Evidence type:** normative design amendment; no structural or execution
+fixtures change. `AUTHORITY.md` precedence and fixture evidence rules remain
+unchanged. Source record: DSPy `roadmap/05-decisions.md`, D-052.
+
+## Reason and exact scope
+
+D-026 treated purity as a universal ban on adapter placement. It also said
+execution placement could never be an artifact requirement. That restriction
+confused a declared transformation with a code-free representation.
+
+Adapters are where program code meets the LM. Formats can carry executable
+code. Purity means declared transformations without hidden LM calls or effects.
+Artifacts must declare code identity, dependencies, language, execution
+requirements, and enough placement information to run honestly. Hosts supply
+compatible bindings. Typed interfaces and transformation behavior stay invariant
+across local, sandboxed, and remote placement.
+
+This supersedes D-026's no-placement/no-rung-walk exception and reconciles
+`spec/placement.md`, PIR-012, component 4's manifest description, and the
+LANG/PROFILE distinction in `spec/errors.md`. D-026 stays in source history;
+D-052 supersedes it explicitly. The broader D-040 draft is not ratified by
+this amendment.
+
+Source sync accompanies this amendment in DSPy's `roadmap/IR-program-spec.md`
+(§Adapter-notes, §e0-lang, §e0-class) and `roadmap/adapter-ir-spec.md`
+(ADP-002, §9). Related planning summaries point to D-052. No implementation,
+profile predicate, schema, corpus, or version pin changes.
+
+## Preserved limits
+
+- Single-shot remains PIR-008/L2. Adapter code cannot call an LM, including
+  through a tool/interpreter grant bridge. Multi-call policies remain explicit
+  component-5 control flow: authored, lowered, or refused.
+- Adapter code holds no credential values. Artifacts declare names, never
+  values (PIR-005). Hosts own executor transport authentication. Declared
+  execution transport is not hidden inference or ambient network access by
+  the transformation. This does not select a broker or change TLS policy.
+- Identity differs from location. Identity deviations detach scores;
+  re-placement is recorded without detaching them (PIR-010).
+- Receiver bindings win before sidecar materialization. Unsatisfied requirements
+  refuse loudly. No fixed backend or mandatory sidecar is introduced.
+- Isolation remains independent: floors bake, envelopes bind. No silent floor
+  reduction, trust bypass, or new effect permission follows from placement.
+- D-023/DT-002/DT-003 still limit declared-tier adapters to data-only entries
+  and exclude authored-origin code. Remote placement does not make code data-only.
+- Holding declarations does not authorize running them. No new load-time
+  execution permission follows from this amendment.
+
+## Context, not executor evidence
+
+LMCC `contract/spec/kernel.md` §5 and its decision D-24 already describe shipped
+formats with `write`, `read`, optional `describe`, `language`, `deps`, `sha256`,
+and `authored_by`. Loading does not run these functions. Hosts admit or refuse
+execution. Section 6's strategy `placement` instead routes field values into
+messages or controls; it does not place executable code.
+
+LMCC D-24 and kernel §9 state that Go leaves `udf:python` cases unclaimed.
+Go's `lmcc/formats.go` verifies the hash, then refuses with `udf-unplaceable`;
+it supplies no code placer. Thus existing data-path conformance cannot prove
+local, sandboxed, or remote format executor support. This amendment neither
+changes LMCC nor adopts a new LMCC protocol.
+
+## Follow-up gates, not implemented behavior
+
+1. Specify and review the code/placement declaration shape and versioning.
+   Decide placement ownership within component 4, code identity/dependency
+   verification, binding compatibility, and typed value marshaling. Do not
+   infer an adapter ABI from existing tool/interpreter data-plane rules.
+2. Specify host admission and execution boundaries, refusal codes/details,
+   lifecycle, resource limits, cancellation, transport authentication, and
+   provenance. Preserve no hidden effects or LM calls. No backend is selected.
+3. Reconcile `schema/manifest.schema.json` descriptions after review, notably
+   `$defs.code_identity.properties.origin` (obsolete D-026 exclusion) and
+   `$defs.adapter_preset_ref` (obsolete builtin-only profile wording).
+   `$defs.adapter_full_preset` still describes a valid profile limit but cites
+   D-026; cite D-023/DT-003 instead. These schema texts remain unchanged here
+   because schema edits are outside this documentation amendment's scope.
+   Permissive schema slots do not establish a new byte contract or executor.
+4. Add reviewed structural fixtures for declarations, compatibility/refusal,
+   identity versus re-placement, and unchanged declared-tier exclusions.
+   Add execution fixtures for binding-first selection, unsatisfied placement,
+   invariant typed results, no hidden LM calls, credential isolation, and
+   floor enforcement. Use AUTHORITY's evidence rules and dedicated fixture
+   commits with no spec changes. Existing fixtures remain historical evidence
+   for their pinned operations, not coverage of a new execution path.
+5. Implement and test each claimed executor only after those gates. Keep
+   unsupported capabilities refused or explicitly unclaimed. Existing grade,
+   profile, and corpus claims do not widen automatically.

spec/errors.md

@@ -16,8 +16,8 @@ Python type names).
 | `LINK` | dangling refs | `-001` binding names absent pool entry · `-002` delta without entry |
 | `VERIFY` | declared-tier verification | `-001` credential unresolved (names name+scope) · `-002` endpoint serves wrong identity · `-003` system dep missing · `-004` envelope under-runs the effective isolation floor (names leaf + floor + envelope; D-042, PIR-015/016) · `-005` declared grant unsupplied by the envelope (names grant + leaf; D-042/D-043, PIR-018) |
 | `NODE` | node-set compile refusal | `-001` un-whitelisted node (names node kind + location) · `-002` unresolved call (names target + location) · `-003` record-splat key refused — splat/kwarg collision or callee-unaccepted key (names key + location; D-041) · `-004` write to the read-only input record (names record + location; D-041) |
-| `LANG` | cross-language / rung-walk | `-001` no satisfiable rung (names component + language + rungs tried). Adapter-layer code never enters the walk (D-026) — its refusal is `PROFILE`, not `LANG` |
-| `PROFILE` | profile predicate | `-001` clause violated (names clause id) · `-002` authored-origin adapter code present (the D-026 refusal) |
+| `LANG` | cross-language / rung-walk | `-001` no satisfiable rung (names component + language + rungs tried). D-052 removes the adapter exception; profile admission still applies before walking. Adapter executor refusal details remain a separate fixture gate (spec/placement.md) |
+| `PROFILE` | profile predicate | `-001` clause violated (names clause id) · `-002` authored-origin adapter code present outside an engine's claimed profile (D-023/DT-003; D-052 preserves this profile limit, not a universal code ban) |
 | `SHIM` | protocol-level failures, reserved | `-001` internal shim error (carries native error name) · `-002` unknown op · `-003` malformed request — distinct from artifact refusals so the harness can tell "artifact refused" from "shim broke" |
 
 ## Rules

spec/invariants.md

@@ -72,8 +72,13 @@ design-intent style with ratification date.
   is the author's preflight. WHY (D-023).
 - **PIR-012 — Language is declared.** Every `packaged` and `authored` code
   entry carries `language`; the artifact carries one env block per language
-  present. Authored adapter-layer code never rung-walks (templates-as-data
-  are the portable customization path). WHY (D-025, D-026).
+  present. Executable adapter/format entries also declare code identity,
+  dependencies, execution requirements, and placement needs; hosts bind
+  compatible execution without changing the typed transformation contract.
+  Data-only templates need no code placement. Authored-origin code remains
+  outside the declared-tier profile. WHY (D-025; D-052 supersedes D-026's
+  no-placement/no-rung-walk exception; spec/placement.md). The concrete
+  code/placement ABI remains a separate specification and fixture gate.
 - **PIR-013 — The signature is sacred; exhaust is never program state.**
   Prediction fields = declared output fields, no more, no less; mechanism
   exhaust (`_trajectory`) is observability, never serialized as program

spec/manifest.md

@@ -14,7 +14,7 @@ ratified contract field.
 | 1 | module tree + bindings | tree | leaves bind `{adapter, lm, delta?}` by name |
 | 2 | signature | per-predictor | fields: name, direction, desc, shape (JSON Schema, constraints included), semantic_role; `prefix` optional-deprecated |
 | 3a/3b/3c | instructions / demos / config | per-predictor | instructions live here only; demos carry `input_keys[]` |
-| 4 | adapter pool | pool | adapter-ir preset entries, by reference to that contract |
+| 4 | adapter pool | pool | adapter-ir preset entries, by reference to that contract; executable format identity/requirements and placement are permitted by D-052 (spec/placement.md), with byte shape still to specify |
 | 5 | forward | per-module | node-set JSON (`spec/node-set.md`) |
 | 6 | tools | pool | identity + return_schema + source + deps + language + placement |
 | 7 | interpreter | pool | open structural identity profile + placement; legacy fused `kind` readable only |

spec/placement.md

@@ -1,5 +1,45 @@
 # Placement — the ladder, the rung-walk, the declared-tier profile
 
+## Executable adapters and formats (D-052)
+
+Adapters are where program code meets the LM; formats can carry executable
+code. Purity means declared transformations without hidden LM calls or
+effects, not absence of code or execution placement. This supersedes
+D-026's universal ban on adapter placement and rung-walking.
+
+Executable entries must declare code identity, dependencies, language,
+execution requirements, and enough placement information to run honestly.
+Hosts supply compatible bindings or refuse loudly. The typed transformation
+interface and behavior stay invariant across local, sandboxed, and remote
+placement. Data-only templates need no code placement.
+
+The existing placement laws apply: identity differs from location; a receiver
+binding wins before sidecar materialization; re-placement is recorded.
+Identity deviations detach scores, placement changes do not (PIR-010).
+Isolation is independent of placement: floors bake, envelopes bind, and a
+host cannot silently lower a floor. Placement never bypasses profile or trust
+admission. The declared-tier profile below still excludes authored-origin code.
+
+Component 4 still cannot call an LM or hold credential values. Single-shot
+behavior and explicit component-5 multi-call control flow remain (PIR-008).
+The tool/interpreter leaf's declared-call permission does not extend to
+adapter transformations. Host-mediated transport to a declared executor is
+not an LM call or ambient network access by the transformation. Transport
+authentication belongs to the host, outside adapter code; the artifact names
+credentials but never carries their values (PIR-005).
+
+**Boundary of this amendment:** D-052 records the maintainer-authorized
+principle, not approval of a new execution ABI. The code/placement byte shape,
+host binding API, value marshaling, and sidecar lifecycle remain separate
+specification and fixture gates. Existing tool/interpreter transports do not
+establish an adapter ABI. Current schemas, fixtures, and conformance claims
+do not establish support for new format executors. See
+`changes/2026-09-07-adapter-code-placement.md` for evidence and follow-ups.
+
+LMCC kernel §5's shipped `write`/`read`/`describe` formats supply context, not
+a required backend or ABI. LMCC strategy `placement` (§6) routes field values
+into messages or controls; it does not place executable code.
+
 ## The placement block (per placeable component)
 
 ```json
@@ -112,6 +152,9 @@ Every walk is recorded as a re-placement in provenance. Sidecar wire
 contracts are out of 1.0 scope (candidates in dspy D-027). Whether the
 walk extends to *other* rung-0 unsatisfiability (RAM, missing GPU) is a
 DRAFT open question — D-022 ratifies only the foreign-language trigger.
+D-052 removes the adapter component-class exception to this policy; it does
+not require declared-tier engines to execute authored code or materialize
+sidecars.
 
 ## The declared-tier profile (D-023) — grade 2's v1 target