Transitive effects, unforgeable authority, and cross-domain admission.
Core-1 Effects, Capabilities, and Boundaries
Status: normative preview
C1-EFF-001 — Closed effects. The canonical effect order is io, alloc,
time, random, reflect, unsafe, abort, compute, state, flow,
and optimize. Effect sets are explicit, duplicate-free, and serialize in
that order.
C1-EFF-002 — Transitive inclusion. A caller’s declared set must contain every effect declared by every directly called callee. Applying this rule to all call edges enforces transitive inclusion. Overrides may narrow but may not widen the inherited effect contract.
C1-CAP-001 — Authority is separate. A privileged operation requires both its declared matching effect and a live unforgeable capability issued by the owning runtime. Writing an effect name never constructs, clones, extends, or serializes a capability.
The preview embedding boundaries enforce the same split: source-backed compute requires an opened opaque device, state publication requires a store-owned transaction, recorded activities require a live flow run, and optimization requires an opened opaque optimizer. Provider or executor enums are policy choices, not authority.
C1-CAP-002 — Lifetime. Capabilities are scoped to their runtime admission and cannot cross a durable checkpoint, be embedded in a checked artifact, or outlive the engine/device/store/search authority that issued them.
C1-BOUND-001 — Closed boundary matrix. The following table fixes the
admissible 5×5 source/target pairs. direct is available only on the diagonal.
A named boundary is typed and capability-bearing. An em dash is forbidden.
| From \ To | algorithm | compute | state | flow | optimize |
|---|---|---|---|---|---|
| algorithm | direct | Device.run |
Store.transact |
FlowEngine.start |
Optimizer.run |
| compute | owned return | direct | — | — | — |
| state | post-commit reaction/outbox | post-commit reaction/outbox | direct | post-commit reaction/outbox | post-commit reaction/outbox |
| flow | recorded activity | recorded activity | recorded activity | direct | recorded activity |
| optimize | report return or sealed pure evaluation | sealed compute evaluation | — | — | direct |
C1-BOUND-002 — Compute confinement. Compute code cannot directly publish, perform external calls, mutate state, start flow, or invoke optimization. It returns an owned result or status to its admitting boundary.
C1-BOUND-003 — Transaction confinement. An active state transaction cannot perform an irreversible boundary. It may stage post-commit reactions and outbox records, which become eligible only after atomic commit.
C1-BOUND-004 — Flow recording. Flow invokes other domains only through typed recorded activities. Replay consumes the recorded decision/receipt and does not repeat an already recorded external decision.
C1-BOUND-005 — Optimize confinement. Optimize may evaluate sealed pure algorithm or compute signals and return a report. It cannot directly mutate a store or flow run.