Semantic Compiler and Semantic Control Layer: Contracts, Controlled Software Construction and Execution Semantics

1. Problem, Research Question, and Contribution

1.1. The Software-Construction Problem

Natural-language requests describe intended outcomes without necessarily fixing all implementation choices, environmental assumptions, security boundaries, or acceptance conditions needed to construct an application. Model-assisted development can propose these missing details, but a proposed interpretation is not by itself an authorized specification.

The construction problem therefore has two coupled parts: establishing what the requested software is permitted and required to do, and producing an implementation that satisfies this established meaning. Treating both parts as an unrestricted conversation leaves implementation choices, tool access, and completion judgments dependent on implicit model decisions.

The Semantic Compiler makes the construction boundary explicit. It converts the request into an editable semantic representation, identifies unresolved commitments, and produces a checked contract. Implementation proceeds against that contract. Missing material meaning produces a semantic diagnostic and, where necessary, a request for clarification.

The compiler handles architectural choices, component integration, security requirements, and software-quality obligations to the extent that these matters are represented by admitted specifications, profiles, rules, and checks. A property without an adequate specification or verification procedure remains an explicit obligation. The architecture does not turn an unrecorded preference into a proved implementation requirement.

1.2. Distinct Failure Modes

The construction must distinguish five failures:

1.

Specification failure: missing, ambiguous, or conflicting commitments silently become consequential choices.

2.

Candidate failure: generated content is malformed, unsupported, or functionally incorrect.

3.

Authority failure: an operation acquires an effect, resource, or data access without an authorized basis.

4.

State and context failure: an obligation loses its binding, an outdated value is reused, or unverified prose is promoted to an authoritative fact.

5.

Completion failure: progress, a model’s assertion, or budget exhaustion is mistaken for fulfillment of the task.

These failures need different checks. Well-typed content can be incorrect; a technically valid operation can be unauthorized; a safe run can terminate without fulfilling its goal. SCL treats erroneous model outputs as arbitrary candidate values, including unsupported factual claims. Its authority-safety objective must not depend on a model’s confidence or error distribution. An output check can establish a schema and permitted recipient; a privileged decision requiring a factual premise needs evidence of that premise.

1.3. Persistent State and Bounded Working Context

Retained project information need not fit into one model invocation. SCL separates persistent, versioned semantic state from an operation-specific working context. The latter is constructed from declared dependencies and applicable constraints rather than inherited as an unrestricted conversation.

This separation addresses a different problem from increasing input capacity. Liu et al. report position-dependent retrieval and question-answering performance in the models and tasks they study, including degradation when relevant information occurs in the middle of a long input [1]. SCL’s requirement is structural: mandatory dependencies remain represented and available under the contract, independently of whether a model uses them correctly.

Caching, prefetching, and model selection are possible policies within this boundary. Cached values retain their validity conditions; predicted usefulness grants no access and cannot justify discarding a required constraint. Reduced inference cost is an empirical objective, to be measured together with compilation, verification, storage, and repair costs.

1.4. Compiling Stable Structure Instead of Repeatedly Inferring It

Once a workflow’s control, dependencies, and admissible effects are established, repeatedly asking a model to rediscover that structure adds an avoidable interpretation boundary. Compiled AI demonstrates deterministic orchestration with bounded semantic model slots where needed [37]; TraceCompiler extracts reusable procedures from supported trace dependencies [38]. These precedents motivate moving stable structure into checked software. They do not make compilation or the absence of runtime inference a sufficient correctness condition.

SCL addresses the joint construction problem: the application and its required control functions must share one declared meaning. State management, context projection, resource control, and effect admission are therefore part of the construction obligation rather than informal instructions the user must repeatedly supply. Local inference is a supported baseline; an external model is an additional bound destination, not an implicit requirement. Technical resource management covers steps, compute time, memory, context size, and model invocations. Pricing, tariffs, payments, and billing are not required compiler functions.

This account does not require a model to stop producing erroneous candidates. It requires that such candidates cannot bypass the checks for a protected use. Whether compilation reduces total work is evaluated over construction, checking, storage, repair, and execution; fewer runtime tokens alone do not establish that result.

1.5. Research Question

The research question is:

How can a semantic compiler turn revisable natural-language commitments into software whose construction, component bindings, and execution preserve an explicit contract, while confining probabilistic models to contract-defined operations?

The question concerns a continuous semantic relationship across construction stages. A typed intermediate representation alone does not establish this relationship. Nor does an execution monitor alone establish that the monitored program implements the confirmed source commitments.

The formal account must connect:

1.

the recorded source commitments and their revisions;

2.

the checked application contract;

3.

the intermediate program and its authorized effects;

4.

candidate implementation artifacts and their evidence;

5.

the generated application and its concrete environment.

Each connection requires its own correctness condition.

1.6. The Intender

Definition 

(Intender). Theintenderis the principal who determines the intended application, supplies or authorizes material commitments, and coordinates refinement of the contract. The intender may edit the semantic representation and inspect diagnostics, plans, implementations, and evidence.

The compiler takes responsibility for resolving and implementing technical obligations within the admitted construction rules. The intender retains authority over the intended purpose and material changes to it.

This division does not require the intender to prescribe every algorithm or library. It requires that consequential choices have an authorized basis: an explicit commitment, an applicable versioned profile, or a permitted standard binding. Where that basis is absent, the compiler reports the unresolved choice.

1.7. Contribution Structure

The contribution is organized around the following formal objects and relationships:

1.

an editable Semantic Abstract Syntax Tree (SAST) with binding provenance and explicit unresolved obligations;

2.

a checked contract separating intended application behavior from the authority used to construct it;

3.

a typed control representation for deterministic operations, model operations, verification, and effects;

4.

a construction and execution boundary that binds admitted artifacts and operations to their evidence;

5.

a compositional preservation argument across translation, construction, execution, and authorized revision.

These objects define a single preservation problem from source commitments to application behavior. Section 5, Section 6, Section 7, Section 8, Section 9 and Section 10 define the operational construction; Section 11 proves its abstract properties; Section 12 supplies a restricted construction witness. Typing, capability restriction, replay, and temporal monitoring are attributed to their existing lines of work.

The intender transition has a precise technical meaning: material commitments stay with the authorized principal while technical construction and execution proceed under a checked contract. It is an allocation of authority and obligations. Whether this changes programming practice at scale is an empirical question.

2. System Boundary and Lifetimes

2.1. Compiler and Generated Application

The Semantic Compiler is the software-construction system. Its result is an application together with the bindings and controls required to realize its contract.

Definition 

(Generated application). A generated application is a tuple

$$\mathcal{A}=(P,R,B),$$

where:

• P is the generated target program;
• R contains any additional execution support required by the contract;
• B binds the program and support components to their declared interfaces, effects, and versions.

The support component R may be empty when the required controls are correctly realized by P and its ordinary execution environment.

The intended construction has the form

$$\begin{array}{cc}\hfill n& {⇝}_{\mathcal{D}}(A,\pi )\stackrel{\mathsf{check}}{\to }{C}_A,\hfill \\ \hfill C_A& \stackrel{L}{\to }I{R}_A\stackrel{{\mathsf{construct}}_{C_B}}{\to }(P,R,B).\hfill \end{array}$$

Elaboration proposes a source representation; checking establishes its admitted contract; lowering fixes intermediate control; construction supplies a realization under a development contract. These arrows have separate correctness obligations. Construction may propose several implementations without changing the active application contract.

SCL is the semantic control realized by this application structure. It need not appear as a separate process, interpreter, or service. A control obligation may be discharged statically, implemented in target code, or enforced by an explicitly bound runtime component.

An implementation may remove a separate control component only when its obligations remain satisfied by the resulting implementation. Absence of model calls does not by itself discharge ordinary application obligations such as input validation or restricted access to external systems.

The word frontend denotes the compiler’s input-analysis and elaboration phase, not a graphical interface. An interface specifies what crosses a component boundary: inputs, outputs, authority, effects, observations, and errors. Its mathematical meaning can be fixed without selecting an API or user interface. SAST is defined here as Semantic Abstract Syntax Tree, a semantically enriched abstract syntax tree; AST retains its conventional meaning, abstract syntax tree.

The principal objects have different roles:

Object	Role in the preservation chain
$n,A,\pi$	Request, candidate SAST, and recorded binding origins.
$C_B,C_A$	Authority for development and behavior of the application.
$I{R}_A$	Checked operational control lowered from $C_A$.
$P,R,B$	Target program, required support, and semantic bindings.
$\mu ,\kappa$	Persistent semantic state and a bounded working view.

The control obligations remain in force when their implementation moves from R into P or B. An empty support component is a realization result, not the removal of the logical SCL.

2.2. Development Authority and Application Authority

Let $C_B$ be the development contract and $C_A$ the application contract.

The development contract determines which operations may be used to construct, inspect, verify, and release an application. The application contract determines the behavior and effects of the application after construction.

These contracts can employ the same type, effect, and evidence machinery while governing different activities.

For an effect e, there is no general implication

$$e\in \mathsf{Caps}\left(C_B\right)⟹e\in \mathsf{Caps}\left(C_A\right).$$

A permission to invoke a development model, inspect a repository, or execute a build tool is not automatically exported into the application. Exported bindings must be justified by $C_A$.

Conversely, constructing an application that contains a model operation requires an application-level specification of that operation. The use of a model during development does not imply the need for a model during application execution.

2.3. Roles of Probabilistic Components

The architecture preserves three distinct roles:

1.

Development assistance. A model proposes interpretations, designs, source changes, or proof artifacts during construction.

2.

Application operation. A model performs a declared function of the generated application.

3.

Revision assistance. A model proposes a contract or implementation change after a semantic diagnostic or uncovered situation.

All three roles operate through declared interfaces. A model may supply candidate content, an estimated score, or a proposed change. It does not acquire the authority to change the purpose, capabilities, or acceptance conditions of the active contract.

A nonlinguistic model may require typed inputs, preprocessing, and output validation without requiring conversational memory. Language-model context construction is therefore a component- specific obligation rather than a universal property of all generated software.

2.4. Effect Control and Authorized Revision

Proof obligation 

(Complete effect control). Every concrete effect within the claimed protection scope must correspond to a contract-admitted operation and satisfy its bound conditions. Candidate producers and candidate artifacts must have no alternative path bypassing those conditions. This includes indirect effects through subprocesses, validation tools, network communication, and data disclosure.

This adopts the established requirements of complete mediation and least privilege [2]. SCL prescribes no universal sandbox technology. An implementation must show that its chosen mechanisms enforce the claimed boundary. A statically justified target-code realization must preserve the same requirements as a runtime realization.1

Normal operation follows the checked contract without requiring human approval at every step. Missing material source commitments and material revisions are resolved through the issuer policy. An external approval required by a particular contract is a typed, authenticated input, not an unrestricted override.

A model-proposed repair remains a candidate. Activating $C_{\nu +1}$ requires new checking and the prescribed authority. Evidence and capabilities from $C_{\nu }$ do not acquire validity in the new version merely because their identifiers remain. Migration must preserve the new version’s invariants and explicitly rebind any reused evidence. Claims also state environmental interference assumptions: uncontrolled external writers cannot be ignored in an invariant proof.

Principal-bound use and environment checks.

Authority is indexed by the issuing principal and the active application or development context. A personal authorization does not apply to another intender unless a declared sharing or delegation rule permits it. Delegation attenuates scope; it does not turn possession of credentials into a new task authorization.

An environment check establishes the current availability, versions, and rights of required dependencies. Discovering a missing library does not authorize installation, and discovering an update does not authorize replacing an admitted dependency. Such changes use the applicable development authority and invalidate their dependent witnesses. Offline execution requires all necessary models, profiles, checkers, data, and target operations to be available offline; a local compiler cannot make an external application effect offline.

2.5. Existing Execution Infrastructure

Conventional compilers, interpreters, libraries, operating-system services, databases, and external APIs remain available as target infrastructure.

The Semantic Compiler determines and checks the bindings required by the application contract. Concrete services perform their declared operations through those bindings.

Compatibility, authorization, and implementation correctness are separate conditions:

$$\begin{array}{cc}\hfill \mathsf{Compatible}(b,C_A)& \neg \Rightarrow \mathsf{Authorized}(b,C_A),\hfill \\ \hfill \mathsf{Authorized}(b,C_A)& \neg \Rightarrow \mathsf{CorrectImplementation}\left(b\right).\hfill \end{array}$$

A usable interface is not sufficient authority to invoke it. An authorized interface is not sufficient evidence that its implementation satisfies its specification.

3. Related Work and Result Attribution

3.1. Typed Semantic Release: Purpose IR

Purpose IR uses a typed acyclic dataflow graph with evidence leaves, derived nodes, and declared release or action sinks. Its runtime reconstructs reusable factual state from validated sink results. Its two propositions establish release confinement and purpose noninterference under binding, operator, reconstruction, and determinism contracts [3]. General agent control remains with the host; environment-level effects are outside those propositions.

SCL assigns this mechanism to bounded release fragments: evidence binding maps to declared observations, derivations to typed dependencies, and sinks to admitted reuse or output. The representation must satisfy the original contracts. Repeated releases additionally need an SCL composition argument.

The protected factual projection is not the whole SCL store. Audit records and replay inputs require their own retention and access rules; their presence cannot make raw data available to a later model invocation. Source access, retention, reuse, and disclosure remain distinct permissions.2

3.2. Typed Workflow Structure: FAOPs

FAOPs provides typed state threading, local call frames, and four normal forms: explicit atomic steps, checked dataflow, canonical shared procedures, and scope confinement. The scope discipline narrows tool permissions and accumulates restrictions down the call structure. Algebraic laws rely on truthful footprints, pure predicates, and leaf-bound nondeterministic outcomes [4].

SCL assigns these mechanisms to typed IR blocks, component calls, versioned reuse, and inherited obligations. A stored model decision read by a pure predicate still needs the evidence required for a privileged SCL continuation. Canonical procedure identity does not establish observable uniqueness of the source contract.

A transformation borrowed from the workflow algebra must preserve SCL’s selected observations, including relevant effect order, release, failures, and resource exhaustion. Equal final records are insufficient when these observations differ.3 The present construction does not extend its serial core to concurrency merely because the comparison work admits parallel scheduling.

3.3. Execution Identity and Replay: Pollard

Pollard identifies steps through causal ancestry, step kind, attempt, and canonical inputs. It couples admission with reservation and settlement; strict replay returns a verified stored result without invoking the wrapped operation. Its exact retained-lease resource theorem assumes serializable accounting, reservations held through settlement, and equality of reserved and charged resources [5].

SCL assigns these mechanisms to dispatch identities, receipts, resource admission, and logical replay. Relevant contract, handler, input, and dependency versions must participate in the SCL binding. The caller-selected operation boundary in Pollard becomes an explicit coverage obligation for SCL.

Strict replay, live cache reuse, and resuming a real operation have different semantics. Current reuse must revalidate current conditions. An uncertain reply must not erase possible effects or consumption. A proposed use of conservative resource maxima requires its own accounting argument.4

3.4. Temporal Enforcement: MENTOR

MENTOR combines finite-trace temporal requirements, entity-bound events, argument constraints, and game-based strategy templates. It uses a model labeler for some natural-language inputs and outcomes [6]. Its implementation permits termination after configured call thresholds even if duties remain open [6].

SCL assigns temporal checking to a contract-bound verifier or monitor. The event projection, entity identities, and argument evaluation need explicit justification. A model-produced event label remains a candidate unless its required interpretation is established.

An admitted pending action can be checked against known history; a proposition depending on its outcome cannot be treated as known before execution. Environmental assumptions of the strategy model must match those of the adapter.

SCL distinguishes successful completion from unsuccessful termination. Budget exhaustion cannot discharge an open success obligation. Progress advice and bounded execution therefore remain separate from a guarantee of fulfilling the task.

3.5. Compilation, Candidate Synthesis, and Neighboring Controls

SIGIL compiles authored skills into a typed AG-IR and lowers them deterministically while preserving model decisions at designated instructions. In particular, its delegated instruction leaves internal orchestration to the runtime agent [11]. SCL requires an admitted subprogram or a checked replacement contract before such internal orchestration can cause protected effects.

Djinnlang separates existence, unambiguity, and implementation correctness for formal specifications. Its procedures include ordered effects through a generated driver, so it is not described here as a purely functional synthesis system [12]. SCL uses the distinction between these obligations and additionally asks for context, resource, and concrete-adapter preservation. A driver being generated by a trusted translator is precisely a boundary requiring justification.

CaMeL separates control and data flow and uses capability tracking against injected data [13]. SCL’s compatible design principle is that untrusted content does not create authority. Its source-to-contract fidelity, construction lifetime, and target-realization obligations are separate additions to that comparison; none is proved simply by using capabilities.

Agentic Redux supplies a central invariant-checking commit discipline and oracle-trace reasoning [14]. SCL uses that inductive proof pattern while explicitly accounting for external effect prefixes and unknown outcomes. Any additional commit principal must meet the same invariant obligations.

Grounded Inference motivates deterministic encapsulation of generative components [19]. StateFlow makes state-driven workflows explicit [20]; a model-selected transition is admissible in SCL only through its declared checking boundary. These comparisons motivate a precise authority semantics, not a claim that state machines are new.

VIGIL, Agent-C, and AgentSpec supply behavioral or temporal enforcement mechanisms [21,22,23]. Their use as SCL components requires fixed policy meaning, sound event interpretation, and effect coverage. A monitor for an existing agent is not automatically a proof for source elaboration or application construction. ProbGuard’s predicted risk can inform restriction or additional checking [24]; a probability estimate does not certify a privileged premise.

Generation constraints such as ChopChop [29] can improve the proposal stage, while type-and-effect synthesis such as RunbookFX is a relevant adjacent line [30]. No external mechanization result from those works is assumed by the proofs here.

Nearby compiler and frontend results.

Compiled AI separates compiled orchestration from bounded semantic inference [37]. COVENANT compiles natural-language workflows into explicit control, while ARTIC makes read/write artifacts and local faithfulness checks explicit [16,39]. ARTIC’s scenario-based dry runs support its evaluated translations; they are not a universal semantic equivalence proof. TraceCompiler requires supported producer–consumer dependencies and leaves uncertain edges unconfirmed [38]. Its reduction in runtime calls does not include a complete accounting of offline compilation. Compilation-Based Semantic Operators approximates model-backed data operations [40]. Substitution in SCL needs exact refinement or a contractually specified approximation relation. These works preclude attributing novelty to the bare language-to-control pipeline or to removing repeated orchestration inference.

Doc2Spec supplies grammar-guided rule formalization [41]; its cited v2 evaluates six API documents in Solidity and Rust. VeriSpecGen decomposes requirements and links localized specification repairs to tests [42]. Its reference implementation supplies black-box test labels. Proving those test judgments is distinct from proving that an arbitrary specification captures human intention. Balis et al. separate intent extraction, deterministic generation, and expert-authored workflow knowledge [43]. Intent Engine supplies schema-bounded intent-to-SLO translation and grounding, not placement or runtime QoS optimization [44]. SkillFusion’s typed, scoped, source-linked constraints help locate interactions, but model-assisted conflict resolution is not authority to discard a hard SCL commitment [45].

Admission, history, and concrete safety.

Symbolic Constraint Agents mines and checks tool-call constraints [46]. Its warning mode acts after a result; repair can fall back to warning when a unique repair is unavailable. Mined rules remain candidates in SCL. The Certified Execution Harness transfers Petri-net safety to a concrete execution under initial correspondence, step simulation, safety reflection, and complete mediation [47]. Its least-intrusive result has additional finite-model, proposer-support, environment-support, and interleaving premises. SCL neither adopts its Petri-net architecture nor derives universal progress or optimality from its safety theorem.

Beyond Policy Engines separates independently required sources, exact bindings, evaluation, and execution admission [48]. Its positive-admission rule is explicitly necessary, not a sufficiency theorem about external effects. Runtime Control binds decisions to relevant history and permanently invalidates an old allowance after a relevant change [49]. Its dispatch theorem does not prove an exactly-once target effect. These comparisons sharpen the interfaces of Section 4 and Section 6, rather than supplying those interfaces merely by citation.

Memory integrity, observation, and diagnosis.

PerMIT binds trusted action arguments to exact values and tools and states reasoning integrity relative to a complete display transcript [50]. Its base endorsement does not additionally bind task, purpose, time, or an entire argument combination. Its reported Lean verification concerns the disclosed single-user core; it is not SCL verification. Compaction Laundering demonstrates attacks on flattened role provenance [51]; tested resistance in role-typed configurations is an empirical boundary. Governance-State Corruption shows that unchanged retrieved content can be used under corrupted validity metadata [52]. Its restoration is oracle-backed, not a proved general autonomous repair.

DelegateGuard separates capability attenuation from content release: an authorized observable sink can still carry unauthorized content [53]. AgenticRV distinguishes observation sufficiency from a pre-effect enforcement boundary [54]. TMA-NM’s origin-bound authority and its bounded-model results motivate preserving authenticated origin, without transferring an unrestricted impossibility theorem [55]. AgentTriage binds retrospective diagnoses to canonical events and abstains when mandatory evidence is absent [56]. That diagnosis is distinct from prevention and from replay of an execution. The present system uses these precise distinctions without requiring an additional audit platform.

3.6. Revisable Assumptions and Proof Methods

Default reasoning permits conclusions whose assumptions can later be defeated [7]. Truth maintenance records reasons supporting beliefs and revises dependent conclusions [8]. SCL locates these mechanisms in construction state; the particular reasoning semantics remains a parameter rather than an implicitly chosen default-logic or answer-set implementation.

Local correctness obligations use preconditions, postconditions, and invariant preservation [9]. Compiler preservation needs a source–target behavior relation, following the verification discipline exemplified by CompCert [10]. These are proof methods and precedents, not certificates for SCL components.

3.7. Conditions for Transferring a Result

Let X be a compared semantics, $R_X(q,x)$ a representation relation on its covered fragment, and ${\pi }_X$ an event projection. A local simulation obligation has the form

$$\begin{array}{cc}\hfill R_X(q,x)\wedge q{\stackrel{\ell }{\to }}_{SCL}{q}^{\prime }⟹\exists x^{\prime }:& x{{\pi }_X(\ell )}_X{x}^{\prime }\hfill \\ & \wedge R_X(q^{\prime },x^{\prime }).\hfill \end{array}$$

The projection maps relevant labels to event words and permits an empty word only for irrelevant administration. The right-hand side permits finite administrative steps. The relation must hold initially, preserve the predicates needed by the adopted result, and justify every hypothesis of that result. Failures and unresolved cases need a defined mapping. Erasure may not hide an effect relevant to the claimed property.

This schema alone is not a theorem for the entire architecture. A release projection, for example, deliberately omits environment effects and therefore cannot certify their authorization. Each such boundary requires its own witness.

Composition additionally requires agreement on contract epochs, component versions, data and entity identities, effect boundaries, event meanings, and resource accounting. Individually valid components can otherwise check different states or incompatible specifications. The SCL objective is to establish their compatibility under one active contract.

3.7.0.5. A common interface witness.

A local result becomes a component of the preservation argument only through a witness with the following shared meaning:

Field	Required agreement across the boundary
Identity	Operation occurrence, entity, candidate, artifact version, request and result correlation.
Authority	Issuer, principal, scope, purpose, and permitted delegation under the same active contract.
State	Relevant dependency versions and history; target-side validity at the point of effect.
Observation	Attempt, admission, dispatch, concrete effect, receipt, and stage success have corresponding meanings.
Failure	Reject, definite failure, timeout, and unknown preserve their specified continuations and outstanding obligations.
Resources	The same technical dimensions, reservations, unsettled work, and measurement boundaries are used.
Information	Input provenance, content release, destination, retention, and permitted reuse agree.
Revision	Changed dependencies invalidate or rejustify affected evidence before use in the new epoch.

This is an interface specification, not a new control architecture. For example, a release-safe output and a capability-safe dispatch can still compose incorrectly if they refer to different destinations or epochs.

The simulation must cover environment steps and pending effects, including steps after a controller returns unknown. The safety-transfer lemma in Section 11 makes the induction explicit. Liveness additionally needs progress conditions; arbitrarily many invisible steps cannot be erased to claim successful termination.

4. Source Commitments and Contract Formation

4.1. Candidate Semantic Representation

Let n be a natural-language request and $\mathcal{D}$ a versioned signature of admitted types, pure operations, predicates, effect handlers, model interfaces, profiles, and standard bindings.

Elaboration is a candidate-producing relation:

$$n{⇝}_{\mathcal{D}}(A,\pi ),$$

where A is a Semantic Abstract Syntax Tree (SAST) and $\pi$ records the source and justification of its bindings.

The relation may be implemented using forms, parsers, symbolic rules, models, or a combination. Its output is not authoritative merely because it is well formed.

A SAST node records at least

$$\begin{array}{cc}\hfill \mathsf{Node}=(& id,kind,\tau ,binding,source,\hfill \\ & obligations,children).\hfill \end{array}$$

Containment is represented by the tree. Shared dependencies and references form a separately resolved graph. An unresolved field remains explicit; a successful parser does not silently supply its intended value.

A source or SAST edit produces a new candidate identity and invalidates evidence whose dependencies change. Independent evidence may be retained only if its binding remains valid. Dependency cycles are checked against the semantics of the relevant representation; the containment tree does not imply that every dependency graph is acyclic. The visible workspace is an editing and inspection surface, not a separate route to accepting an artifact.

4.2. Revisable Construction State

Definition 

(Construction state). A construction state is

$$Z=(H,D,A,J),$$

where H contains the currently binding commitments and hard constraints, D contains admitted defeasible rules, A is the current candidate SAST, and J records the justifications of derived bindings.

A derived binding records its supporting premises and rule version. Changes to those premises trigger revalidation of the dependent binding.

The specification must account for positive support and defeasible conditions such as the absence of a defeating fact. Alternative valid justifications may preserve a binding when one justification is withdrawn.

The selected reasoning procedure must report unresolved material alternatives rather than treating an implementation’s search order as authorization to choose between them.

The selected inference semantics and its checking procedure must be identified by the profile. This definition does not implicitly select a default-logic or answer-set implementation. Similarity can retrieve an earlier case or propose a binding, but current hard constraints still require checking.

A revision of Z creates a revised candidate. It does not mutate an active application contract.

4.3. Binding Origin and Material Choices

Resolution of an unresolved field follows this precedence:

1.

an explicit authorized commitment;

2.

a uniquely applicable authorized versioned profile;

3.

a permitted non-material standard binding;

4.

otherwise, an unresolved binding and semantic diagnostic.

Precedence selects an eligible origin; it does not make conflicting commitments consistent. An explicit binding incompatible with a hard constraint still produces an error.

Every selected value records its origin.

A technical binding is material when it changes an intended outcome, security condition, data location, external effect, authorized technical resource boundary, or acceptance meaning. An unresolved material binding requires an authorized resolution.

A profile may supply material detail only within the authority already granted to it. A standard binding cannot silently add a material commitment.5

Rules may derive consequences of authorized grants or instantiate a grant within its declared scope. They may not enlarge that scope because an operation is useful, available, or technically compatible.

4.3.0.6. Bounded search and authorized selection.

A candidate producer may return a finite set $K_b(n,Z)$. Its cardinality describes the search, not the set of all intended meanings. Define the formation requirement

$$\begin{array}{cc}\hfill \mathsf{Admissible}\left(A\right)\equiv & \mathsf{Typed}\left(A\right)\wedge \mathsf{Closed}\left(A\right)\hfill \\ & \wedge \mathsf{HardConsistent}\left(A\right)\wedge \mathsf{SourcesCovered}\left(A\right)\hfill \\ & \wedge \mathsf{BindingAuthorized}\left(A\right)\wedge \mathsf{ChecksDischarged}\left(A\right).\hfill \end{array}$$

Each test names a procedure and a soundness obligation; the formula does not implement those procedures. Unknown subchecks do not count as true. Here the tests use the contract description and evidence proposed by the candidate: in particular, SourcesCovered on a SAST abbreviates the inventory test on that description and evidence. This does not activate the proposed contract before formation succeeds.

A profile may preauthorize a selector among admissible bindings within a declared decision envelope. Material equivalence is defined by that profile’s requirements and observations or established by evidence; it is not inferred from similar model responses. A technical optimizer can choose a permitted library or decomposition without changing those commitments. A material choice outside that envelope requires authorized resolution. Thus clarification is triggered by missing material authority, not by the mere presence of a model operation.

An optimization grade may bound construction effort, clarification depth, and the use of authorized defaults for a deliverable initial version. It cannot weaken hard checks, invent a material default, or enlarge capabilities. If the selected effort cannot discharge a required obligation, the outcome remains a diagnostic. Subsequent intentions enter through a new contract version.

Expert knowledge is admitted as versioned profiles and rules with issuer, scope, applicability conditions, and justification dependencies. A defeated premise or rule change invalidates its dependent derivations unless an independently valid justification remains. The nonmonotone consequence relation stays a profile parameter. Source-linked skills and retrieved cases can propose such knowledge; their retrieval or successful past use is not its current authorization.

4.4. Checked Application Contract

The application contract has the structure

$$\begin{array}{cc}\hfill C_A=(& \nu ,\pi ,\mathcal{D},P_C,\mathsf{Inv},\mathsf{Goal},\hfill \\ & \mathsf{Caps},\mathsf{Ctx},\mathsf{Bud},\mathsf{Obs}).\hfill \end{array}$$

Here:

• $\nu$ identifies the contract version;
• $P_C$ is its checked control description;
• $\mathsf{Inv}$ specifies hard state invariants;
• $\mathsf{Goal}$ contains the stage-specific terminal requirements;
• $\mathsf{Caps}$ bounds permitted effects;
• $\mathsf{Ctx}$ specifies required data and, where applicable, context, retention, reuse, and release conditions;
• $\mathsf{Bud}$ supplies declared execution bounds;
• $\mathsf{Obs}$ identifies the behavior relevant to contract correctness.

Architectural and software-quality requirements are represented through the applicable bindings, invariants, operation specifications, and acceptance predicates. Their informal names do not constitute verification procedures. Development and application contracts instantiate the shared structure for their respective activities.

For a declared theory $\mathcal{T}$, the frontend result is a tagged value with the following interface:

$$\begin{array}{cc}\hfill \mathsf{Frontend}(n,Z,b)\in \{& \mathsf{accepted}(C,w_C),\mathsf{ambiguous}\left(W\right),\hfill \\ & \mathsf{inconsistent}\left(U\right),\mathsf{unsupported}\left(d\right),\mathsf{inconclusive}\left(d\right)\}.\hfill \end{array}$$

The parameter b bounds elaboration and checking work, not the meaning of the request. $\mathsf{accepted}$ requires actual discharge of the formation checks declared mandatory by the profile. Its witness $w_C$ identifies the contract, authorized sources, checks, certificates, and explicit local assumptions. An assumption used by a conditional result is labelled as such; it is not relabelled as a proved certificate.

The remaining tags record different obstacles:

• $\mathsf{ambiguous}\left(W\right)$ supplies materially different eligible interpretations and the unresolved choice;
• $\mathsf{inconsistent}\left(U\right)$ supplies a sound contradiction witness for the authorized hard commitments in $\mathcal{T}$;
• $\mathsf{unsupported}\left(d\right)$ identifies required semantics, operations, or checking outside the admitted profile;
• $\mathsf{inconclusive}\left(d\right)$ records insufficient evidence, incomplete search, solver unknown, or exhaustion.

A fixed profile determines diagnostic precedence when several obstacles are present. No proof of inconsistency follows from an empty search result, and a single candidate found does not prove that no other natural interpretation was intended. A timeout cannot produce acceptance.

Authorized source commitments are recorded separately by a relation such as

$$\mathsf{Confirm}(n,C,\pi ,u),$$

where u is an authenticated principal permitted by the issuer policy. This records which commitments are authoritative. Previously authorized profiles can supply technical bindings without a new decision for every operation.

4.5. Independently Required Sources and Evidence Closure

Let ${\Gamma }_{\mathrm{auth}}$ be a finite, authorized, versioned basis of issuers, profiles, source roles, and applicability rules. Its identity is bound through $\pi$ and the registry. Required obligations are resolved before inspecting which supporting sources happened to be supplied:

$$({\mathcal{O}}_C,{\Phi }_C)=\mathsf{ResolveRequired}({\Gamma }_{\mathrm{auth}},C,\mathsf{app}).$$

Here ${\mathcal{O}}_C$ is the finite inventory and ${\Phi }_C$ is its authorized positive obligation formula. Conjunction expresses jointly mandatory roles; disjunction expresses an authorized choice of alternatives. The applicability input $\mathsf{app}$ has its own evidence and freshness conditions. The inventory is not defined as the sources currently loaded. Its normative adequacy and the sound execution of its resolver are distinct obligations.

For supplied evidence E, let $d_E\left(o\right)=1$ only if a registered check discharges exactly obligation o with the required issuer, subject, epoch, predicate, and dependencies. Invalid or missing evidence has value zero for positive admission. Define

$$\mathsf{SourcesCovered}(C,E)\equiv {\Phi }_C\left(d_E\right)=1.$$

An unresolved check can instead cause $\mathsf{inconclusive}$; zero here means no positive discharge, not a semantic proof that the underlying proposition is false. The resolver checks that applicable mandatory roles are not silently omitted and that any vacuous formula is expressly authorized. An alternative is fixed or selected only under its authorized choice rule.

For example, the inventory ${\Phi }_C=a\wedge (b\vee c)$ requires role a and either permitted alternative b or c. Loading b alone cannot change the formula to b. Loading both $b,c$ does not waive a, and the contract need not require both alternatives. This isolates the source-completeness issue identified by BCEAC [48].

Evidence closure also requires a justified checking path. A verifier descriptor records

$$v=(id,\mathsf{version},\psi ,\mathcal{T},\mathsf{domain},\mathsf{basis},\mathsf{effects}).$$

Its soundness statement has the form

$${\mathsf{Accept}}_v(p,e,b)⟹\psi (p,e,b)$$

over its specified domain and binding interpretation. The descriptor identifies the proof, already justified checker, or explicit trusted premise supporting that implication. A generated checker is candidate code until this path is admitted.

Checking dependencies form a finite proof DAG whose roots are explicitly trusted axioms, authenticated assumptions, or a sound fixed proof-checking kernel. Each inference rule used in the DAG has a truth-preserving interpretation in the stated theory. A root that is a deployment assumption remains an assumption. Self-approval and a cycle of mutually approving generated checkers do not replace roots. This is the relevant producer/checker separation of proof-carrying code [31,57].

A verifier’s sound judgment and its permissible execution effects are separate properties. Logical verification in the core creates only the stated evidence. Concrete reads, subprocesses, model inputs, and writes needed to obtain that judgment require mediated operations under the applicable contract. The proof path therefore does not grant a checker unrestricted execution authority.

4.6. Distinct Formation Obligations

4.6.0.7. Structural closure.

Execution-relevant references and variables are bound; operation signatures, effect scopes, failure paths, context requirements, and terminal predicates are present where required. Closure is checked against the finite representation and its declared profile. It does not mean every possible informal preference has been captured.

4.6.0.8. Consistency.

Formal commitments must be jointly satisfiable in the selected theory. Contradictory hard commitments produce a diagnostic rather than an implicit priority choice.

4.6.0.9. Realizability.

Let $X_C$ be the admitted input domain, ${\mathcal{E}}_C$ the stated class of environments, and ${\mathsf{Traces}}_C^{{\mathcal{E}}_C}\left(x\right)$ the behavior relation specified by the contract. A nonvacuous instantiation supplies nonempty input and environment classes. Its finite traces include admitted failures as well as successful outcomes. Let

$${\mathsf{Success}}_{C,j}^{{\mathcal{E}}_C}\left(x\right)\subseteq {\mathsf{Traces}}_C^{{\mathcal{E}}_C}\left(x\right)$$

be the traces specified to complete stage j successfully, including that stage’s goal obligations.

One possible existence obligation is

$$\forall x\in X_C:{\mathsf{Success}}_{C,j}^{{\mathcal{E}}_C}\left(x\right)\ne ⌀.$$

This asserts existence of a permitted success for each input. It does not assert that one implementable strategy succeeds against every admissible environmental behavior. A contract requiring the stronger property must specify and check the corresponding strategy and environmental quantifiers.

Observable determinacy.

When a stage requires one observable meaning, its obligation is

$$\begin{array}{cc}\hfill \forall x\in X_C,\forall t_1,t_2& \in {\mathsf{Success}}_{C,j}^{{\mathcal{E}}_C}\left(x\right):\hfill \\ & {\mathsf{Obs}}_C\left(t_1\right)={\mathsf{Obs}}_C\left(t_2\right).\hfill \end{array}$$

The environment class is part of this quantification. A claim conditioned on fixed environmental observations must state those observations as an additional index. Creative-output contracts may instead authorize several observably different successful results. A deterministic canonicalization procedure alone does not prove the displayed equality.

4.6.0.11. Source fidelity.

Let

$${\mathsf{Faithful}}_{\mathcal{D}}(n,C,\pi )$$

state that the contract represents the documented intended meaning under the declared interpretation discipline. Type checking and satisfiability do not establish this relation for unrestricted prose. It is supported by authorized clarification, inspection of source bindings, or a separately justified restricted-domain frontend. An unrecorded intention is not silently included in a theorem.

These obligations are distinct. Procedures deciding them must state their theory, domain, and evidence. The specification does not assume a universal decision procedure for arbitrary specifications. A missing required result produces a diagnostic or an explicit open proof obligation; it is not interpreted as a successful check.

4.7. Construction and Application Preservation

Let L lower checked contracts to SCL-IR. The development program $L\left(C_B\right)$ governs the construction of an implementation for $C_A$. Candidate artifacts remain subject to the checks required by $C_A$.

An admitted artifact must be connected to its specification by a refinement relation

$$\mathcal{A}{⪯}_{\mathsf{Obs}}{C}_A.$$

With compatible source and implementation observation projections, its trace-level requirement is

$$\mathsf{Obs}\left(\mathsf{Traces}\left(\mathcal{A}\right)\right)\subseteq \mathsf{Obs}\left(\mathsf{Traces}\left(C_A\right)\right),$$

under the declared input and environment assumptions.

This relation includes declared failure outcomes. A successful termination must additionally satisfy the corresponding $\mathsf{Goal}$ predicate.

For a concrete application, establishing refinement requires the later translation, verification, and adapter obligations. Local evidence and terminal-check witnesses must connect the admitted control to the specified contract relation. Trace inclusion alone permits an implementation that always returns a permitted failure. Successful realization or progress therefore requires an additional, explicitly quantified obligation.

4.7.0.12. Meaning of a realization witness.

For each admitted input x and compatible environment in ${\mathcal{E}}_C$, a realization witness relates concrete states of $\mathcal{A}$ to IR states, starting from every admitted initial state. Every relevant concrete transition, including checker, adapter, and pending-environment steps, has a finite matching IR path with the same specified observation. An empty match is allowed only for administration irrelevant to the property claimed. Corresponding terminal states preserve the outcome and stage identity. Predicates used for concrete goals and invariants are reflected through the state relation; an observation cannot erase an unsuccessful outcome to manufacture success.

The witness also identifies linked code, support, and bindings. Its authority and resource interpretation agrees with the contract, and its environment mapping is uniform over the declared class. A witness valid only for one recorded transcript is labelled with that restriction. Realization of a generated context constructor, checker, or adapter is included: calling it environment does not exempt it from the target obligations.

Proof obligation 

(Compositional contract preservation). Connect authorized source commitments to the checked contract, the contract to its lowered control, candidate artifacts to admitted implementations, and implementation effects to concrete adapter behavior. Establish compatible observations, versions, evidence bindings, and environmental assumptions at every connection.

The intended runtime authority goal is independent of candidate quality. Let $q_0$ be an admitted initial configuration and $\omega$ any external transcript allowed by the declared interfaces. The target statement is

$$\begin{array}{c}\hfill \forall \omega :\mathsf{ProtectedEffects}\left({\mathsf{Run}}_{I{R}_C}(q_0,\omega )\right)\subseteq \mathsf{AuthorizedEffects}\left(C\right).\end{array}$$

Theorem 11.7 establishes this property for the defined abstract core under explicit verifier, primitive, mediation, and adapter hypotheses. Theorem 11.10 states the further requirements for application-level refinement.

The complete source-to-application claim additionally requires the source-fidelity relation. Contract preservation concerns the confirmed contract.

5. Typed SCL Core and Structural Lowering

5.1. Values and Authority-Bearing Types

The value language contains booleans, integers, finite text, finite records and sequences, tagged sums, artifact identities, and target references. A profile supplies total, versioned parsers for additional data. Candidate, evidence, capability, and receipt values have the types

$$\begin{array}{cc}& \mathsf{Candidate}\langle \tau \rangle ,\mathsf{Verified}\langle \tau ,\psi ,b\rangle ,\hfill \\ & \mathsf{Cap}\langle h,op,s,\nu \rangle ,\mathsf{Receipt}\langle h,a,\nu ,outcome\rangle .\hfill \end{array}$$

A binding

$$b=(\nu ,id(p),id(\psi ),id(v),id(h),d)$$

identifies the contract, candidate, predicate, verifier, handler, and relevant dependency stamps d. Mathematical identities are injective. A hash-based implementation instead states canonical-encoding and collision-resistance assumptions. No hash is evidence of a semantic postcondition.

Only admitted checking rules construct $\mathsf{Verified}$; only the issuer/kernel path constructs live capabilities. Ordinary data constructors and model decoders cannot manufacture either type. A string claiming to contain a certificate is candidate data until the certificate is checked. Generated verifier programs likewise remain candidates until checked or explicitly included in the trusted base. This is the producer/checker distinction of proof-carrying code [31].

Evidence certifies exactly $\psi$. For a creative-text application, $\psi$ may concern schema, source restrictions, and delivery only. A later decision requiring a factual claim needs the corresponding additional evidence. Persistence does not strengthen a proposition.

5.2. Commands, Signatures, and Effects

The normalized control description has the grammar

$$\begin{array}{cc}\hfill s::=& \mathsf{skip}\mid x:=f\left(\overline{y}\right)\mid x:={\mathsf{observe}}_h\left(\overline{y}\right)\mid x:={\mathsf{propose}}_m\left(\overline{y}\right)\hfill \\ & \mid z:={\mathsf{verify}}_v\left(x\right)\mid r:={\mathsf{act}}_h(z,c)\mid s_1;s_2\hfill \\ & \mid \mathsf{if}b\mathsf{then}{s}_1\mathsf{else}{s}_2\mid {\mathsf{repeat}}_{N}s\hfill \\ & \mid \mathsf{reject}\left(e\right)\mid \mathsf{halt}\left(j\right).\hfill \end{array}$$

The repeat count N is a nonnegative bound fixed by the contract. Typed case analysis on $\mathsf{ok}\left(z\right)$ and $\mathsf{bad}\left(e\right)$ is an abbreviation for checked tagged branching. Recovery paths are represented in this control; a model cannot install a new edge. A rejection with recovery is shorthand for its explicitly expanded bounded continuation; the structural theorem applies to that expansion. A remaining terminal reject ends unsuccessfully.

Each model descriptor fixes input/output types, permissible models and destinations, context policy, resource bounds, verifier requirements, and continuation. Pure functions and guards are total and effect free. Arbitrary source code cannot be executed by calling it a pure function.

Write

$$\Gamma ;C⊢s:{\Gamma }^{\prime }!E$$

for the typing judgment with conservative effect upper bound E. Value types and effects are distinct, following effect-system discipline [32]. Sequences union effect bounds; branches check both arms and retain compatible common bindings at joins, with typed refinements for guarded uses. A loop body must preserve its declared input interface. Loop-local bindings do not become available outside their scope merely because one iteration produced them. The compiled bound must satisfy $E\subseteq \mathsf{Caps}\left(C\right)$, interpreted as scope inclusion rather than equality of concrete argument strings.

The critical act rule is

$${\displaystyle \frac{\begin{array}{c}\Gamma ⊢z:\mathsf{Verified}\langle \tau ,\psi ,b\rangle \Gamma ⊢c:\mathsf{Cap}\langle h,op,s,\nu \rangle \\ \mathsf{ArgsFit}(z,s){\mathsf{EvidenceReq}}_h\subseteq \mathsf{Certified}\left(z\right)\end{array}}{\Gamma ;C⊢r:={\mathsf{act}}_h(z,c):\Gamma [r:\mathsf{Receipt}]!\left\{(h,op,s)\right\}}}.$$

Freshness, current authority, and resource availability are rechecked dynamically. An effect’s return type describes its outcome; it does not assert that the effect succeeded.

A guard cannot coerce a candidate into an authoritative fact. Candidates can affect payloads after the prescribed checks. Advisory ranking of operation or backend alternatives is admitted only within a contract-declared set $E_C$ after membership and the required equivalence are established:

$$a\in E_C\wedge \forall b\in E_C:a{\simeq }_{C}b.$$

The relation preserves the hard requirements and observations specified for that choice. It is not defined by model scores. This restriction concerns discretionary operation selection; it does not force every permitted creative output to be identical.

5.3. Component Scopes and Semantic Linking

A called component receives its declared inputs in a fresh frame and returns only declared outputs. Its capability set is a subset of its caller’s grants; inherited hard restrictions cannot disappear. Shared procedures have pinned registry identities and interface summaries. Linking checks types, effects, context, evidence requirements, and versions. A dependency update invalidates affected bindings and certificates.

This instantiates the state and scope discipline compared with FAOPs. Correct declarations alone do not guarantee correct implementations: each concrete component must refine its declared footprint. Two different path names or handles may alias one resource. A compiler cannot justify reordering from disjoint names when that aliasing has not been excluded.

A semantic link witness uses the common interface fields of Section 3.7. In particular, equality of input schemas does not establish equality of preconditions, target identity, history dependence, or success meaning. A generated support component is checked in the same way as a reused component. If an optimizer removes a check, its witness must show why the corresponding property follows statically or is enforced by the remaining bindings.

5.4. Structural Lowering

For a normal continuation k, define $L(s,k)$ as follows:

• A primitive yields a block with the same source identity, signatures, operands, effect summary, and normal/error continuations. A service primitive has dispatch and completion phases.
• $L(s_1;s_2,k)=L(s_1,L(s_2,k))$.
• A conditional produces one complementary-guard branch to $L(s_1,k)$ or $L(s_2,k)$.
• A bounded repeat initializes a fresh protected counter to N, tests it, runs the lowered body when positive, and decrements before the next test.
• Reject and halt yield the corresponding declared failure or terminal block; success still requires its predicate.

Skip lowers to an administrative jump. Frame operations preserve component scoping. Counter and frame identifiers are fresh with respect to source variables. No model response is parsed into a replacement instruction graph.

Let $b\left(s\right)$ conservatively bound the resulting kernel steps when each service completion or timeout is delivered once. For a chosen lowering with one initialization, test, and decrement block,

$$\begin{array}{cc}\hfill b(s_1;s_2)& =b\left(s_1\right)+b\left(s_2\right),\hfill \\ \hfill b\left(\mathsf{if}p\mathsf{then}a\mathsf{else}c\right)& =1+\max \left\{b\right(a),b(c\left)\right\},\hfill \\ \hfill b\left({\mathsf{repeat}}_{N}s\right)& =1+(N+1)+N\left(b\right(s)+1).\hfill \end{array}$$

Primitive bounds include their dispatch, completion, and explicit error continuation. Bounds for recovery are calculated over the bounded recovery description, not over an assumed single model call.

Source/IR preservation in Section 11 uses adequate administrative fuel. An observation that includes physical administrative cost additionally requires a cost-refinement relation; erasing a counter does not erase its measured computational work. No optimizer is certified merely by this structural construction.

5.5. Expressiveness Boundary

The core is serial and bounded. General target computation remains available through contracted programs and handlers; control expressiveness and a particular invocation’s resource bounds are different properties. Turing completeness is independent of both contract completeness and bounded live termination. [36] Typed oracle calculi such as ${\lambda }_A$ are relevant precedents [28]; the lowering argument here begins with this specification’s normalized source semantics.

6. Operational Semantics and Protected State

6.1. Configurations and Concrete Worlds

The full configuration is

$$q=(pc,\rho ,\sigma ,\mu ,C,\beta ,\Lambda ,\zeta ).$$

The components are the IR location, typed working environment, target abstraction, persistent semantic store, immutable active contract, resource ledger, append-only event trace, and pending request descriptor. The executable control locations alone do not constitute the full state.

Let W be the concrete target-state space and let $\gamma \left(\sigma \right)\subseteq W$ be a nonempty set of states compatible with the authoritative abstraction. A known snapshot can be a singleton. An unknown effect outcome can require a larger set. This is a semantic interpretation of target state, not a new uncontrolled store.

Write $q\vDash \psi$ when $\psi (C,w,\mu )$ holds for every $w\in \gamma \left(\sigma \right)$. A verifier can establish a property on a bound snapshot; using it later requires a justified freshness relation transferring that property to the relevant current state. Stored but stale evidence may remain in an archive; it cannot justify a current operation.

External events are tagged by request identity and kind: model response, observation, receipt, clock/measurement, cancellation, or timeout. For fixed versions, the kernel is a deterministic function $\delta (q,o)$; internal steps use a distinguished internal event. Mismatched or malformed events follow explicit error rules. External sources need not reproduce the same events on a later live run.

6.2. Admission Before Dispatch

For an operation a at the current location, admission means

$$\begin{array}{cc}\hfill {\mathsf{Admit}}_C(q,a)⟺& \mathsf{Declared}(pc,a)\wedge \mathsf{CapOK}(q,a)\hfill \\ \hfill \wedge & \mathsf{EvidenceOK}(q,a)\wedge \mathsf{Fresh}(q,a)\hfill \\ \hfill \wedge & \mathsf{ScopeOK}(q,a)\wedge \mathsf{PreOK}(q,a)\hfill \\ \hfill \wedge & \mathsf{TemporalOK}(q,a)\wedge \mathsf{ReleaseOK}(q,a)\hfill \\ \hfill \wedge & \mathsf{ReservePossible}(q,a).\hfill \end{array}$$

Each conjunct refers to a fixed descriptor or a registered check. Observations and model invocations have their own read/disclosure admission requirements. Their necessary evidence may come directly from trusted bindings and local checks; it need not be a preceding model proposal.

Admission records the exact request and reserves resources before dispatch. In the abstract rule this is one serialized transition. A concrete implementation needs the corresponding atomic ordering: a crash cannot leave an unrecorded request executing outside its reservation and authority record.

6.3. Transition Cases

Each positive-fuel kernel transition consumes one unit of step budget and appends its typed audit event. The following cases specify all mutation paths:

1.

Compute/branch. Evaluate a registered pure function or guard and update typed working bindings and the fixed successor. Contract, grants, and protected target data do not change.

2.

Observe/propose dispatch. Check admission, construct admitted context where required, reserve, record, and invoke the bound handler. Context sent to a cloud endpoint is already a disclosure effect at this step.

3.

Model return. A matching decoded response creates only a candidate in $\rho$. Malformed data creates a typed failure. The trace may retain untrusted response content under its own storage policy; it does not become a trusted fact or monitor label.

4.

Verify. The registered verifier returns $\mathsf{ok}\left(z\right)$ with a protected evidence value or $\mathsf{bad}\left(e\right)$. Unknown, timeout, and unsupported certificates cannot create evidence.

5.

Act dispatch and completion. Admission rechecks current bindings and atomically guarded state dependencies. Completion consumes only a matching outcome. A definite success updates the target abstraction and permitted memory effects; a certified no-effect failure preserves the target abstraction. Charges are still settled when work was used.

6.

Unknown outcome. Retain a conservative abstraction of possible effects and unresolved reservation. Dependent operations cannot treat the request as either successful or rolled back. The reference core terminates the invocation with $\mathsf{EffectUnknown}$; reconciliation is a separate admitted operation.

7.

Reject/halt. Rejection follows a compiled bounded recovery or yields failure. A successful halt at stage j is enabled only by its checked completion predicate.

Protected persistent writes are registered effects, including writes with no external target mutation. A memory handler must satisfy the same authority, evidence, and invariant requirements.

At zero fuel, the next transition terminates with budget exhaustion. If a request is pending, its uncertainty and durable reservation are preserved. Ending a kernel invocation does not claim that a remote process has stopped or that its resource consumption ended.

6.4. Verifier and Handler Obligations

Proof obligation 

(Verifier soundness). If v constructs $\mathsf{Verified}(p,\psi ,b)$, then ψ holds on the state dependencies identified by b. The identity, epoch, and verifier version are correct. A fresh use preserves the meaning of this binding.

For a handler h, let ${\mathsf{Beh}}_h(w,a)$ contain its possible concrete execution prefixes, states, effects, and outcomes. Its local certificate must show:

1.

each concrete effect belongs to the admitted handler effect specification;

2.

its precondition implies invariant preservation at every protected visible boundary and every prefix included in the global invariant claim;

3.

its abstract pending and outcome transitions overapproximate all possible concrete states;

4.

certified observations and receipts are truthful about their claimed properties and request identity;

5.

charged or still possible use is covered by its reservation or enforced lifetime resource bound.

For an atomic handler, pending knowledge may include the pre-state and all permitted post-states. If intermediate mutations are visible, those states must also satisfy the claimed invariant. An authentic success receipt alone does not prove that an unsafe intermediate state never occurred. Finite traces include controller steps and concrete target steps. A terminal controller may retain permitted pending external behavior; only established quiescence excludes further effects of that request.

Freshness requires an actual snapshot comparison, transaction condition, or equally strong mechanism at the effect boundary. Comparing only a controller’s cached version is insufficient when an independent target writer can change the object. Multiple targets do not become one atomic transaction by sharing a contract. External interference must be excluded or satisfy an explicit rely relation preserving the invariant and invalidating affected evidence.

6.4.0.13. History-bound freshness and the ABA case.

For each relevant dependency r, let $g_r$ be a protected generation that strictly increases whenever a change invalidates earlier decisions about r. Evidence records both the snapshot identity and its relevant generations in d. A conservative exact use rule includes

$$\mathsf{Current}(d,q)\equiv \underset{r\in \mathsf{Deps}\left(d\right)}{\bigwedge }d.g_r=g_r\left(q\right).$$

The dependency rule must cover every invalidating fact, policy, authority, and component change. An implementation can instead use a proved equivalent history predicate. A finite counter must not wrap into an old live identity.

Thus $a\to b\to a$ does not restore earlier evidence: the value can recur while its generation changes. A new check can issue new evidence; it does not revive the old token. Runtime Control provides a direct history-based precedent [49].

This comparison must reach the actual target. Dispatch therefore requires a target-side conditional operation or an equally strong rely condition preventing an invalidating change between the check and the relevant effect. If external writers are permitted, their events must enter the dependency semantics in time for this rule. Two independent APIs do not acquire atomic joint semantics by sharing a generation in controller memory.

6.5. The Invariant and Trusted Base

${\mathsf{Good}}_C(q,w)$ means that $w\in \gamma \left(\sigma \right)$, ${\mathsf{Inv}}_C(w,\mu )$ holds, live environments are well typed, authority-bearing values have admitted constructors and the active epoch, pending requests have valid descriptors and reservations, the resource inequalities hold, and the trace records the provenance of admitted operations. Archived stale evidence is permitted but cannot satisfy $\mathsf{EvidenceOK}$.

The trusted base comprises the checking or certificate-validation path, lowering realization, kernel, opaque-value representation, context constructor, proof checkers, deadline and metering mechanisms, and conformant effect handlers. The model and its free-text self-assessment are outside it. Naming these components does not certify an implementation; their local obligations remain inspectable deployment requirements.

7. Persistent State, Context, and Information Release

7.1. Typed Persistent Cells

A cell is

$$u=(id,\tau ,value,source,\nu ,dependencies,validity,trust).$$

The store distinguishes commitments, observations, candidates, verified artifacts, released facts, and receipts. A model-authored summary retains its candidate status unless an admitted check certifies the property for which it is reused. It cannot replace the source commitment merely by being shorter.

For instruction i, let ${\mathsf{Need}}_C(i,q)$ be its finite mandatory dependency set. Its elements include applicable constraints as well as input values. A profile supplies a dependency rule and justifies its adequacy for the operation. Missing undeclared knowledge is not discovered by the notation $\mathsf{Need}$.

The validity and origin metadata are protected semantic state, not annotations inferred from cell prose. Their issuers, currentness, conflict rules, and revocation channels have admitted bindings. Governance-State Corruption motivates this separation even when the retained text is unchanged [52]. For a particular operation, the use test is

$$\begin{array}{cc}\hfill \mathsf{UseOK}(u,i,q)\equiv & \mathsf{Valid}(u,q)\wedge \mathsf{ReleaseAllowed}(u,i,C)\hfill \\ & \wedge \mathsf{DependenciesCurrent}(u,q).\hfill \end{array}$$

A valid observation need not be an authorized disclosure, and an authentic historical commitment need not remain applicable.

7.2. Canonical Projection and Coverage

The context constructor

$$\kappa =K(C,pc,\rho ,\sigma ,\mu ,\Lambda ,{\Pi }_i)$$

uses a pinned ordering, source selection, representation policy, destination, and size measure. It returns either an admitted context or a typed diagnostic. It does not copy arbitrary trace content into the model input.

Let $\mathsf{Cover}(\kappa ,u)$ mean that the exact cell is present or that a checked representation preserves the specific property needed from it. A summary’s compression ratio or similarity score is not such a certificate. Dispatch requires

$$\begin{array}{cc}\hfill {\mathsf{Need}}_C(i,q)& \subseteq \mathsf{Covered}\left(\kappa \right),\hfill \\ \hfill \mathsf{Sources}\left(\kappa \right)& \subseteq {\mathsf{Allowed}}_C(i,q),\hfill \\ \hfill \mathsf{ValidVersions}(\kappa ,q)& ,\mathsf{size}\left(\kappa \right)\le L_i.\hfill \end{array}$$

If required representations do not fit, the result is $\mathsf{ContextOverflow}$ or a separately checked decomposition, not silent deletion. The context theorem proves these checks are operative at invocation; adequacy of the declared dependency rule and correct model use are separate obligations.

Persistent storage can grow beyond $L_i$. The architecture therefore supports a large accessible store and bounded active views without asserting that all stored information is simultaneously visible to a model. InfiAgent supplies practical persistent-store/bounded-context evidence [15]; Constraint Drift motivates preserving operative commitments across memory and delegation [26]. Neither is imported as the proof of the displayed inclusions.

7.2.0.14. Compression is a checked representation change.

A summary r is initially a candidate derived from source cells. Its protected binding identifies those cells, their origins, dependencies, contract epoch, and permitted use. Text resembling a role label or an approval does not create this binding. Compaction Laundering gives a concrete failure mode for conflating textual labels with authenticated origin [51].

For every property $\phi$ required from a source cell u, an admitted alternative representation supplies an appropriate preservation judgment

$${\mathsf{RepOK}}_{i,\phi }(u,r,b).$$

Its meaning is fixed by the consumer’s interface: for a required predicate it preserves that predicate’s interpretation; for an exact input field it preserves the field value. A generic similarity score establishes neither judgment. The certificate is itself version-bound and becomes unusable when a relevant dependency changes.

If a required judgment is unavailable, the constructor retains the authoritative representation or reports overflow. It cannot replace a mandatory cell with an uncertified shorter sentence. PerMIT’s exact value/tool integrity and its display-transcript condition illustrate why the object and scope of release must be stated [50]. SCL additionally binds the current contract, purpose, dependencies, and operation. Its gate may be a sound automated checker; no human decision at every use is imposed.

No lossless compressor for arbitrary free text is assumed. This construction proves coverage of declared needs under the representation contracts.

7.3. Release Fragments and Repeated Writes

A release fragment is a finite typed DAG with declared evidence leaves, derived nodes, and sinks. Only leaves bind raw evidence; a derived node reads typed predecessors and declared literals. Each operator has a sound output, provenance, and codec contract. Fresh reusable factual state is constructed from validated sinks only. These are the bounded mechanisms assigned to Purpose IR.

Let ${\mu }^{rel}$ denote active reusable factual state, distinct from private audit storage. The release condition is

$$x\in \mathsf{FactSem}\left({\mu }^{rel}\right)⟹{\mathsf{AuthorizedJustification}}_C\left(x\right).$$

The justification records the sink, approved ancestors, derivations, version, and destination. Appending a label authorized without these witnesses does not satisfy the condition. Every insertion into ${\mu }^{rel}$, including a cache write or cross-component handoff, uses this boundary.

Sequential confinement follows by induction on store writes once each release fragment satisfies its contracts. Deletion preserves confinement. Replacing a cell requires a new justification. On revision, active reusable cells are filtered or rebound under the new contract. Historical audit evidence remains historical; revocation does not retroactively undo information already disclosed.

For a fixed fragment F, write $O_1{\equiv }_F{O}_2$ when their sink-relevant leaf results agree. Deterministic typed evaluation and sink reconstruction then give

$$O_1{\equiv }_F{O}_2⟹\mathsf{FactSem}\left(ou{t}_F\left(O_1\right)\right)=\mathsf{FactSem}\left(ou{t}_F\left(O_2\right)\right).$$

This compares factual releases under fixed declared control. A larger workflow could leak information through branch selection, abort status, timing, or choice of sink unless those channels are also included in its observation and checked relation. The local statement is not presented as global side-channel noninterference.

7.3.0.15. Information-flow claims require a relational boundary.

Trace inclusion alone does not transfer a two-run confidentiality property. Consider a source relation permitting public outputs $\{0,1\}$ for either secret $h=0$ or $h=1$. Its possible-output sets are equal. A refining deterministic target that always outputs h selects a permitted source output for each input but reveals h completely. Thus pointwise trace refinement does not preserve even this possibilistic independence property.

Proposition 11.14 instead fixes the release fragment and equal sink-relevant leaf completions. A global claim would need a relational realization witness coupling runs, relevant choices, and release or display transcripts. The application refinement theorem is a trace-property result and is not used as a substitute for that missing relational witness.

7.4. Cache, Prefetch, and Reclamation

A reusable entry is bound to contract and component versions, dependency stamps, input meaning, representation codec, and permitted destination. A hit is eligible only when those bindings remain valid; the eventual operation still passes current admission. Changing a relevant dependency invalidates the hit. A predictor may rank already authorized data or components, but all reads and disclosures remain governed.

For an already admitted model instruction, a fixed resource policy may select

$${\mathcal{R}}_C(q,i,\eta )=(m,backend,allocation),$$

where $\eta$ contains recorded measurements and any advisory scores. The selected model, CPU/GPU/NPU placement, and allocation must belong to the contract’s permitted bindings and respect their budgets. Selection cannot add a capability or waive evidence. Discretionary model-based binding choices obey the equivalence boundary in Section 5.

Working-context eviction may discard derived views. Persistent reclamation cannot remove a live mandatory dependency or required evidence without preserving a valid retrievable representation. A dangling archive pointer does not meet coverage.

Hardware KV-cache management, such as PagedAttention [33], concerns inference-serving storage. It does not determine whether a user’s obligation is dispensable. Context Compilation Architecture uses model-generated structured context and checks [25]; in SCL both remain candidates until admitted under the present rules.

8. Verification, Temporal Obligations, and Target Effects

8.1. Predicates and Evidence Scope

A verifier is specified by its exact predicate $\psi$, dependencies, soundness condition, and error behavior. Finite test success proves the test predicate. A universal functional property requires a sound decision procedure or checked proof for that property. Independent test generation may improve error detection, but statistical independence of two models does not establish logical soundness.

For a repository, evidence can bind the base identity, parsed patch, resolved resource footprint, protected-test identities, toolchain, and acceptance certificate. Scope must include symlinks, file modes, submodules, generated writes, subprocesses, and network effects where they are possible. A changed-path list alone does not cover all these effects.

8.2. Temporal State and Entity Identity

Let ${\mathsf{Events}}_C\left(\Lambda \right)$ project trusted structured events, validated outcomes, and specifically verified facts. Raw model labels do not become propositions by occurring in the log. The monitor state is derived:

$$m_q={\mathsf{Monitor}}_C\left({\mathsf{Events}}_C\left(\Lambda \right)\right).$$

It is not a second autonomous controller. Entity keys preserve the identity relation required by the contract; unproved string normalization cannot merge distinct protected objects.

A pending call’s argument predicate can inspect verified prior history. Outcome-dependent propositions are updated only after their outcome is established. A possible environmental result must be covered by the model used to justify pre-dispatch choices. For each monitored property, the adapter demonstrates correspondence between concrete events and the monitored alphabet.

As a simple safety requirement for a protected object r, use

$$G\left(\mathsf{write}\left(r\right)\to O\mathsf{verified}\left(r\right)\right),$$

where O is the inclusive past operator and a verification and write are distinct events. The verified event also binds candidate, epoch, and dependency stamp; the object name alone is insufficient. This example says a verified premise precedes the effect. It does not prove the premise without its verifier obligation.

The observation projection must be adequate for each claimed monitor verdict. If two concrete prefixes have the same projected history but require different answers, no deterministic function of that history can answer both exactly. AgenticRV states this observation-sufficiency condition independently of monitor formalism [54]. SCL therefore records the property-specific projection, entity scope, verdict interpretation, and pre-effect control point. Dropping events can change temporal distance and requires revalidation. An insufficient projection permits a conservative rejection or an inconclusive result; it cannot justify a fabricated positive verdict.

8.3. Completion and Open Duties

Let $D_j\left(q\right)$ be the stage predicate and ${\mathsf{Due}}_j\left(m_q\right)$ its unfulfilled mandatory duties. The contract records ordered stages $don{e}_C=[({\ell }_1,D_1),\dots ,({\ell }_n,D_n)]$. A later stage can require valid evidence of an earlier one; technical readiness, review readiness, and release readiness therefore remain distinct when specified by the profile. The successful-halt guard is

$${\mathsf{Complete}}_j\left(q\right)\equiv D_j\left(q\right)\wedge {\mathsf{Due}}_j\left(m_q\right)=⌀\wedge {\mathsf{ResolvedDeps}}_j\left(q\right).$$

The stage checker must have a soundness witness

$$D_j\left(q\right)⟹\forall w\in \gamma \left(\sigma \right):{\mathsf{Goal}}_{C,j}(w,\mu ,\Lambda ).$$

A predicate named done without that witness does not establish the goal. Here ${\mathsf{ResolvedDeps}}_j$ excludes unresolved effects or evidence on which that stage depends. Failure, rejection, cancellation, or exhaustion have distinct terminal statuses. They cannot discharge a success duty.

A game-based strategy template can justify safe choices and progress opportunities under its environment assumptions. Actual progress additionally needs the controller’s chosen strategy to satisfy its progress conditions. Blocking unsafe choices alone does not prove eventual success.

8.4. Realization and Concrete Effects

A target adapter supplies typed observation, effect execution, canonical delta, and evidence checking. A refinement witness relates its concrete state to $\sigma$, maps its observable effects to the contract, and covers every operation within the claimed boundary. Audit-only integrations cannot satisfy pre-effect mediation merely by recording a violation afterward.

Controller-state rejection is insufficient when an action may already have changed the world. This distinction is explicit in COVENANT’s stated scope [16]. FAVA makes mediation, capability-conformant backends, and trusted policy translation assumptions explicit [17]. CAVA’s fingerprints and receipts support identity binding [18]; none of these mechanisms proves an unstated application postcondition.

If R is empty, target code and its bound environment must supply the corresponding refinement witness. Removing a monitor or capability check is admissible only when a static proof or an equivalent target mechanism discharges that obligation.

9. Execution Identity, Resources, and Replay

9.1. Identity and Observation

A semantic request identity binds

$$id\left(a\right)=\mathsf{Id}(\nu ,p{c}_s,parent,attempt,handlerVersion,inputs,dependencies),$$

where $p{c}_s$ identifies the source operation. The mathematical model uses an injective encoding; a cryptographic realization states its weaker computational assumption. Administrative counter steps do not silently become new semantic parents during lowering. Optimized programs with new bindings or versions do not inherit an old replay identity without an explicit relation.

Runtime measurements used for backend selection, including queue state, hardware availability, or learned advisory scores, are recorded external inputs. A fixed deterministic selection policy does not make unrecorded measurements reproducible.

9.2. Resource Conservation

Each resource claim specifies its metered scope. If it includes local verification, context construction, or other kernel work, those costs must also be reserved or charged before consumption. An external-call ledger alone does not bound unmetered local work. For each additive resource dimension, let S be settled use, R the set of outstanding reservations, $e_i\ge 0$ the reservation of request i, and L its limit. Admission requires

$$S+\sum _{i\in R}{e}_i+e_{new}\le L$$

and inserts the reservation atomically. A known completion removes $e_i$ and adds a charge $c_i$ satisfying $0\le c_i\le e_i$. An unknown completion retains the reservation until reconciliation establishes a justified replacement charge or quiescent no-use outcome. Definite failure may still have a nonzero charge.

Each reservation must dominate the request’s entire as-yet-unsettled lifetime use: consumption already incurred and any possible further consumption, including work continuing after a lost reply. Under these conditions the same accounting bounds actual use, not merely the recorded ledger. Lease expiry alone is not evidence that the work stopped. This is the additional obligation needed to avoid applying Pollard’s retained-lease theorem outside its premises.

The serial core needs serialized local accounting. If independent workers share a limit, their accounting must be serializable at that shared scope. This is an implementation condition, not a concurrency extension to the control calculus. A restart or contract migration cannot discard outstanding obligations.

Resident memory is an occupancy dimension with allocation and reclamation rules; it is not the sum of all historical bytes. Context size has its own limit $L_i$. A wall-time bound additionally needs bounded local evaluation and enforced service deadlines. A step count alone bounds neither arbitrary local computation time nor the lifetime of a remote process.

9.3. Strict Replay and Live Reuse

Strict replay fixes C, the IR and registry versions, the initial state, and all relevant external events. It verifies identities and stored outcomes, applies logical transitions, and never invokes an effect handler. A missing or mismatched event produces divergence; there is no fallback to a live call.

Logical target state can be reconstructed from the recorded abstract transitions. The present world is not thereby restored. For example, replaying a recorded local source-file change reads its stored delta and result; it does not write the file a second time or invoke the model again. An actual new build or retry is a new live execution.

Execution replay reconstructs the logical run. Diagnostic replay recomputes an explanation from a fixed trace, policy, and event mapping [56]. The latter may require less content, but cannot establish missing execution evidence. Model inference itself need not be bitwise deterministic; inference determinism, as studied by Vosti [27], is a separate backend property.

Live cache reuse is a new current admission with eligible stored data. Resuming or retrying real work must determine whether a prior effect is already complete or still uncertain, using adapter-specific transaction or idempotency identities. Strict replay supplies no general exactly-once guarantee for external services.

10. Diagnostics, Residuals, and Authorized Evolution

10.1. Obligation-Directed Diagnosis

A diagnostic identifies the source binding, failed predicate, dependency versions, available evidence, and declared recovery continuation. A model can propose a counterexample, repair, or additional certificate; it cannot reinterpret a failed hard check as success.

Let $g_1,\dots ,g_k$ be mandatory Boolean checks and $s_1,\dots ,s_l\ge 0$ soft deviations. Define

$$r_C(q,a)=(1-g_1,\dots ,1-g_k;s_1,\dots ,s_l).$$

Only an established true check has value one; missing, unknown, or timed-out evidence has value zero. All hard components must be zero. Optional soft optimization uses declared units and weights; it cannot compensate for a hard violation. Local transition predicates and still-open global goals are different: requiring the final goal at every intermediate step would forbid legitimate progress.

The residual is sound for the actual local relation only if

$$r_C^{hard}(q,a)=0⟹{\mathsf{Sat}}_C(q,a).$$

This implication is a verifier obligation. A predicted residual $\widehat{r}$ is an advisory value, not its proof.

For a canonical repository delta $\Delta$ and writable set $S_C$,

$$r_{scope}\left(\Delta \right)=|\mathsf{ChangedResources}\left(\Delta \right)\setminus S_C|.$$

The adapter must resolve the real resource footprint. A large authorized edit may have zero scope residual; a small forbidden edit does not. Zero scope residual says nothing by itself about the functional requirement.

10.1.0.16. Minimal records and evidence-supported diagnosis.

The event record distinguishes a proposal, an admitted dispatch, a confirmed effect, a definite failure, a block, and an unknown outcome. A request identity joins invocation and result; chronology alone does not establish that relationship. A diagnostic assertion records the evidence supporting it or reports an unavailable conclusion. In particular, absence of a log entry is not proof that an effect did not occur unless completeness for that observation has been established. AgentTriage supplies a concrete diagnostic precedent for these distinctions [56].

Only the identities, verdicts, bindings, and evidence required by the contract need be retained. Retention and access are themselves governed; complete conversation storage and a separate audit product are not required. A replay-capable contract must nevertheless retain, or lawfully make retrievable, the external values and versions needed for its claimed replay. Without them the proper result is divergence or unavailable replay, not reconstruction from a new model guess.

10.2. Declared Distances and Stability

The numerical distinctions follow the methodology of forward error, backward error, conditioning, and stability [34,35]. The following semantic quantities are SCL definitions, not imported numerical theorems.

Fix comparable contracts, a commitment distance $d_{com}$, a pseudometric $d_{beh}$ on their declared behavior denotations, and a neighborhood ${\mathcal{N}}_C$. Define

$${\kappa }_{\mathcal{D}}(C;ϵ)=\underset{\begin{array}{c}{C}^{\prime }\in {\mathcal{N}}_C\\ 0<d_{com}(C,C^{\prime })\le ϵ\end{array}}{\sup }{\displaystyle \frac{d_{beh}(〚C〛,〚C^{\prime }〛)}{d_{com}(C,C^{\prime })}}.$$

No comparable perturbation is reported as unavailable, not silently assigned a sensitivity. Empty solution sets are handled separately. An estimate is labeled an estimate.

For a declared interpretation relation,

$${\mathsf{Amb}}_{\mathcal{D}}\left(n\right)=\underset{C_1,C_2\in {\mathsf{Interp}}_{\mathcal{D}}\left(n\right)}{\sup }{d}_{beh}(〚C_1〛,〚C_2〛).$$

A finite sampled set cannot certify absence of additional natural language interpretations. For an output y and nonempty declared solution set,

$${\mathsf{err}}_C\left(y\right)=\underset{z\in \mathsf{Solutions}\left(C\right)}{\inf }{d}_{out}(y,z).$$

A bound such as ${\mathsf{err}}_C\left(y\right)\le L_C\parallel r_C^{soft}\left(y\right)\parallel$, on hard-satisfying outputs, needs a domain-specific proof of $L_C$. Neither similarity nor zero implemented residual recovers an unstated preference.

Authority stability is the safety theorem for arbitrary candidates. Output sensitivity is a property of these specified distances. They must not be conflated with bounded termination or with a universal context-window occupancy threshold.

10.3. Fast and Slow Paths

The fast path reuses an eligible component or certificate under current admission. The slow path produces a candidate or obtains additional evidence and re-enters the same admission boundary. Missing material meaning invokes contract clarification instead.

Both paths preserve the same hard requirements. They need not produce identical creative outputs. Equality follows only where the contract requires and establishes observable determinacy. Performance benefits require measurement including offline costs.

10.4. Epoch Changes and Migration

A proposed $\mathsf{ContractPatch}(C,\Delta C)$ first creates a new SAST candidate. It does not edit the active contract. Activation of $C^{\prime }$ requires the issuer-policy authorization, successful new checking, and a migration witness relating the old state to a state satisfying ${\mathsf{Good}}_{C^{\prime }}$. Quiescence or transfer of pending work, reservations, and effect identities is part of that witness.

Transfer must authorize every still possible effect of the old request under the new contract and preserve its unsettled resource obligations. If the new contract forbids such an effect, activation must await proved quiescence or a sound cancellation result. A contract edit cannot retroactively cancel an already dispatched remote operation.

A live capability or evidence token is either newly issued/rechecked under $C^{\prime }$ or unavailable there. An old identifier is not an implicit grant. Reasoning-state revision, including nonmonotone retraction and case-based retrieval, has no activation transition.

The issuer may preauthorize profile-governed technical refinements. Material changes outside that policy require its declared principal. This retains user authority while allowing ordinary execution and construction without a sequence of manual overrides.

11. Formal Results and Composition

11.1. Hypotheses and the Source Semantics

The results concern the abstract system defined above. Their hypotheses are local obligations:

H1: checked core.

Frontend admission uses the independently resolved inventory and authorized material bindings. Source control is typed and structurally closed; the initial state is good; primitive signatures, scopes, and pure-operation specifications are truthful.

H2: evidence.

Verifier justification follows the rooted checking discipline in Section 4.5. Verifiers and successful-stage checks are sound for their stated predicates and goal implications; opaque constructors, principal bindings, epochs, and history-sensitive freshness checks have the meanings specified above.

H3: mediation.

Every claimed protected effect is mediated, including generated artifacts, tools used for checking, and model-input disclosure.

H4: handlers and environment.

Handler certificates cover effects, visible intermediate states, knowledge abstraction, receipts, and interference as specified in Section 6.

H5: fixed evaluation.

Kernel and registry versions, pure operations, parsing, context ordering, and policy evaluation are deterministic. All external choices used in execution appear in the transcript.

H6: bounds.

Local evaluations finish; pending services return control or receive an enforced deadline event. Claimed resource maxima dominate actual lifetime use and the ledger is serialized and durable.

H7: semantic monitors.

Property-specific observation projections are adequate for their claimed judgments. Event interpretation, release operators, coverage certificates, and temporal monitors satisfy their declared local contracts on the chosen observations.

For source control, use a continuation machine on $\langle s,k,\rho ,\sigma ,\mu ,C,\beta ,\Lambda ,\zeta \rangle$. Sequence pushes its second command as a continuation; skip resumes the continuation; a branch evaluates its guard; a bounded repeat executes its body at most its fixed count; reject and halt use their declared outcomes. A source primitive uses the specified request, checking, and completion protocol. This defines source control independently of the IR counter and jump representation. Repeated source operations carry an occurrence index for identity binding.

Except for the administrative fuel comparison, source and IR use the same primitive specifications, external events, and contractual resource charges. This is the level from which lowering is proved; the unconfirmed interpretation of prose is not assumed to have already been proved correct.

11.2. Formation, Checking Roots, and Local Transfer

The following results state what the additional interfaces establish. They concern the admitted mathematical instances of those interfaces; they do not assert that a general frontend or arbitrary generated checker already satisfies them.

Lemma 

(Rooted checking closure). In a finite acyclic checking derivation, suppose every root is valid under the explicit trusted interpretation and every local inference rule preserves validity from its premises. Then every derived judgment is valid, including an admitted verifier-soundness judgment. A cycle without a trusted derivation is not a witness under this rule.

Proof. 

Order the finite DAG topologically. Roots are valid by hypothesis. At any later node all premise judgments are earlier and valid; the stated soundness of its inference rule establishes the node. Induction proves all judgments. A generated verifier’s claim of its own soundness cannot enter as a derived fact without a prior valid premise or a sound root-level proof. A cycle has no such topological derivation. The conclusion is relative to the roots. □

Proposition 

(Positive admission requires independent discharge). Fix an authorized resolved inventory $({\mathcal{O}}_C,{\Phi }_C)$. Suppose the frontend’s positive rule checks $\mathsf{Admissible}$ with sound local tests and valid checking roots. Then an accepted contract satisfies the declared formation properties and ${\Phi }_C\left(d_E\right)=1$. If o is required in every satisfying assignment of ${\Phi }_C$, missing valid evidence for o excludes acceptance.

Proof. 

A positive result has passed each mandatory formation test. Sound tests and Lemma 11.7 transfer these results to the stated properties; in particular the source check establishes ${\Phi }_C\left(d_E\right)=1$. If a mandatory o has no valid evidence, $d_E\left(o\right)=0$, whereas every satisfying assignment sets it to one, a contradiction. Removing that source from the supplied set cannot remove its independently fixed role from ${\Phi }_C$. □

Lemma 

(Safety transfer through a local simulation). Suppose initial SCL states correspond under $R_X$ to initial states of X. Every covered SCL step, including environment and pending steps, has the finite matching path of Section 3.7. Suppose $I_X$ holds at every reachable state of X, and

$$R_X(q,x)\wedge I_X\left(x\right)⟹I_C\left(q\right).$$

Then every covered reachable SCL state satisfies $I_C$.

Proof. 

Induct over the finite SCL prefix. Initial correspondence supplies a reachable X-state. For a step from a related pair, its simulation supplies a finite matching path and a related successor. That successor is reachable and satisfies $I_X$. Reflection yields $I_C$ at the SCL successor. The induction also covers a matching empty path when the relation preserves that step. All claimed concrete intermediate states must themselves occur in the covered step system; projecting away a relevant unsafe state would violate the premise. No liveness statement follows from this finite-prefix argument. □

Lemma 

(No resurrection by value reversal). Under complete tracking of relevant invalidations and strictly increasing dependency generations, evidence invalidated by such a change cannot become current again merely because values return.

Proof. 

The evidence fixes a generation g. The first relevant invalidation advances it to $g^{\prime }>g$, falsifying the equality in $\mathsf{Current}$. Later generations are at least $g^{\prime }$ and cannot equal g. Restoring a data value changes none of these inequalities. Fresh evidence may bind the new generation. Completeness of invalidation and the target-side guard remain premises; a cached counter with missed events does not meet them. □

11.3. Types, Candidates, and Authority

Lemma 

(Type preservation and classified continuation). Under H1–H2 and truthful typed handler interfaces, a kernel step from a well-typed configuration preserves its live typing or enters a typed terminal diagnostic. A nonterminal configuration either has an internal transition or is waiting for a declared external event.

Proof. 

Proceed by cases on the instruction. Pure evaluation returns its registered type. A branch consumes a typed Boolean or validated tag, and the selected block’s input interface is exactly the checked continuation interface. Joins expose only compatible guaranteed bindings. Repetition changes a protected nonnegative counter and re-enters a body with the preserved input interface. Dispatch creates the descriptor’s typed pending value; completion checks identity, tag, and decoder before introducing its output. The model decoder constructs only a candidate. Verify returns one of the disjoint typed result constructors. Act completion introduces a receipt outcome, not an assumed success proof. Unknown and error cases have declared constructors and continuations. Reject and halt have no unchecked successor. These cases exhaust the grammar. Malformed events select the typed error rule, while a pending wait requires its declared event rather than an invented internal step. □

Lemma 

(Candidate confinement). Under H2–H3, replacing a model response by any other payload cannot directly change the active contract, grants, protected target state, or trusted persistent facts at the model-return step.

Proof. 

The only response decoder outputs a candidate or typed failure. Its write set consists of the candidate binding, the permitted untrusted log entry, accounting, and the compiled continuation. There is no constructor or writable reference for the protected components. H3 excludes a second effect path through the model adapter. Differently decoded values may alter later admissible results, but cannot create a protected token at this step. □

Theorem 

(Model-independent authority and invariant preservation). Under H1–H7, every protected effect caused by the abstract SCL system is authorized by its active contract and bound to the admitted request, scope, and evidence requirements. For every permitted external response sequence, every reachable concrete state paired with its authoritative abstraction satisfies ${\mathsf{Good}}_C$. Unknown outcomes are included through conservative knowledge and retained obligations.

Proof. 

Induct on execution prefixes, including permitted concrete-handler and environmental steps. H1 establishes the base. Compute and branch preserve protected components. Lemma 11.5 preserves live bindings. A model response is confined by Lemma 11.6. Verify adds only sound version-bound evidence by H2. Its logical judgment creates no target effect; any concrete checking effects are separately mediated under H3.

A dispatch is possible only after every admission conjunct holds. Its scope and capability identify a permitted effect; H2 transfers the certified premise to the guarded current dependencies. Context and release admission prevent an extra disclosure at observe or model dispatch. Serialized reservation preserves the ledger inequality by Lemma 11.7 below. The pending abstraction contains every permitted concrete prefix state by H4; local handler obligations preserve the invariant over those states. Consequently the real target may advance during the pending phase without becoming an unrepresented successful result.

At known completion, the sound receipt transition narrows the abstraction to a set containing the actual state, settles the bound charge, and performs only admitted memory changes. At unknown completion, the conservative set is retained and dependent work cannot use an invented success or rollback. Its worst-case resource obligation is not dropped. Reject and exhaustion change control, candidate data, budget, and audit; they do not create a new target effect. A successful halt checks its terminal predicates. Permitted environmental interference preserves the invariant under H4 and cannot validate stale evidence.

These are all effect and state mutation paths. Every concrete effect in a pending request’s allowed continuation is covered by its original admission and H4. None of the cases uses the probability distribution, accuracy, or confidence of model responses. □

The theorem’s world-state conclusion uses local invariant certificates for the actual handlers. The kernel does not prove those certificates by observing a receipt. Without H4, the pre-dispatch authorization conclusion and the world-invariant conclusion are different claims.

Corollary 

(Model substitution). Replacing a model by any candidate-producing adapter satisfying the same invocation, disclosure, and resource interface preserves Theorem 11.7. It need not preserve output quality, success probability, or rejection rate.

Proof. 

The theorem quantifies over every admitted response sequence and does not use model weights or a sampling law. The adapter itself must still meet H3–H6. □

11.4. Lowering and Application Realization

Theorem 

(Structural lowering preservation). Let s be typed normalized source control. Under the same primitive specifications, initial bindings, and external transcript, its source execution and $L\left(s\right)$ have the same contract-observable events and terminal status, provided fuel covers their respective administrative schedules. The observation erases only administrative control/counter steps. A contract observing their cost needs the additional declared cost-refinement relation.

Proof. 

Use structural induction on s, with arbitrary continuation. For a primitive, the bound operation, operands, checks, dispatch, and completion protocol agree. Each returned result therefore introduces corresponding bindings and consumes the same relevant external event. Skip matches a jump to the continuation. For $s_1;s_2$, apply the induction hypothesis to $s_1$ with continuation $L(s_2,k)$. On normal exit the hypotheses hold for $s_2$; a terminal failure or halt bypasses it on both sides. A conditional evaluates the same total guard over corresponding bindings and chooses the same arm, to which its induction hypothesis applies.

For repetition use a second induction on N. At zero both enter the continuation. For $N+1$, the positive counter corresponds to one source-body occurrence. The body hypothesis matches its result and transcript suffix. On normal exit the IR decrement and test correspond to the remaining N occurrences; on early termination both stop at that occurrence. Fresh counters and frames cannot alias source bindings. Reject and halt have identical declared conditions and outcomes. Adequate fuel prevents an extra IR administrative step from causing an unmatched exhaustion. The structural bound $b\left(s\right)$, including recovery costs, supplies the required reservation. Erasing administrative steps yields the stated event and status correspondence. □

Theorem 

(Compositional application preservation). Suppose a checked contract $C_A$ has the above source semantics, lowering satisfies Theorem 11.9, and the generated $\mathcal{A}=(P,R,B)$ has a sound realization witness as specified in Section 4, uniformly over its admitted input and environment classes, refining that IR with compatible observations, outcome and goal interpretation, versions, primitive assumptions, and resource treatment. Then

$$\mathsf{Obs}\left(\mathsf{Traces}\left(\mathcal{A}\right)\right)\subseteq \mathsf{Obs}\left(\mathsf{Traces}\left(C_A\right)\right).$$

Every successful application trace satisfies its stage goal and required temporal duties. This holds with $R=⌀$ only when the target-code realization witness supplies all omitted runtime obligations.

Proof. 

For each concrete application trace, the realization witness gives a corresponding IR trace and observation. Theorem 11.9 gives its source trace with the same contractual observation. Transitivity yields trace inclusion. Corresponding successful terminal labels pass the source goal and duty checks, so the application’s successful trace satisfies them. Failure and unknown outcomes remain non-success outcomes. For an unknown result, the observation also accounts for permitted outstanding external behavior. No part of the argument depends on a separate support process. □

The realization witness is an additional proof object. Running a construction program under $C_B$ proves only its own governed behavior unless its artifact-admission check soundly establishes this witness for $C_A$. Source fidelity adds the separate ${\mathsf{Faithful}}_{\mathcal{D}}$ premise to relate the result to documented user meaning. Trace inclusion by itself does not imply successful synthesis. In particular,

$$\begin{array}{cc}& \forall x\exists t:\mathsf{Success}(x,t),\hfill \\ & \exists s\forall x\forall e\in {\mathcal{E}}_C:\mathsf{Success}\left(\mathsf{Run}(s,x,e)\right)\hfill \end{array}$$

are different obligations. The second requires one admitted strategy that succeeds for all the stated inputs and environments; neither formula follows from the safety theorem. Fairness, response support, and uncontrollable outcomes must be specified if used in a progress proof. The restricted witness below supplies the first kind of existence under its stated favorable completion conditions.

Corollary 

(Source-to-application preservation). Suppose the documented source commitments satisfy ${\mathsf{Faithful}}_{\mathcal{D}}(n,C_A,\pi )$, formation is admitted with sound checks, and artifact admission during a $C_B$-governed construction establishes a realization witness for $\mathcal{A}=(P,R,B)$ under $C_A$. Under the hypotheses of Theorem 11.10, every contract-observable application trace refines $C_A$, and each declared success satisfies the corresponding documented stage requirement.

Proof. 

Formation fixes the admitted contract and its authorized bindings. Artifact admission supplies the realization premise rather than inferring it from successful construction under $C_B$. Theorem 11.10 gives application preservation; the separate fidelity premise identifies the documented source meaning represented by that contract. □

11.5. Context and Release

Theorem 

(Constructed context coverage). Consider an exact-cell constructor that computes the finite mandatory dependency set, checks validity and destination authority, sorts its cells by fixed identities, encodes them with a property-preserving codec, and adds optional authorized cells only within the remaining limit. It returns a diagnostic if any mandatory check fails or the mandatory representation exceeds $L_i$. Under H3 and its dependency/codec contracts, every actual model invocation has authorized, version-valid sources, covers every declared mandatory dependency, and has size at most $L_i$.

Proof. 

Each mandatory cell either passes validity and authority or causes a diagnostic. Thus every successful mandatory encoding is from an authorized valid cell. Its codec preserves the required property, so every member of $\mathsf{Need}$ is covered. A size failure cannot reach dispatch. Optional insertion never removes a mandatory encoding and checks both authorization and remaining capacity. The deterministic sort fixes the ordering. Finally H3 and the dispatch rule exclude an invocation through an unvalidated context path. Checked alternative representations satisfy the same argument through their individual coverage certificates. □

Theorem 

(Sequential factual release confinement). Under the release contracts in Section 7, initially confined active factual storage remains confined after every admitted store transition.

Proof. 

Induct on writes to the active factual projection. A release fragment reconstructs only validated sinks. Trace a factual value’s dependencies backward through its finite DAG. Derived operators introduce no factual input outside approved predecessors and literals; leaves meet their declared semantic binding contracts. Hence each emitted value has an authorized sink-ancestor justification. Inserting those values preserves confinement of the previously stored values. Replacing a value requires the same new argument; deletion cannot introduce an unauthorized value. Other transitions do not write active factual storage. Epoch migration filters or rechecks that projection before activation. Private audit retention does not create a new active factual write. □

Proposition 

(Fragment noninterference). For a fixed release fragment with deterministic valid execution, equal sink-relevant leaf completions yield equal factual releases.

Proof. 

Induct over a topological order of its sink-relevant subgraph. Leaves agree by hypothesis. Each next node has equal typed predecessors, so its guard and operator produce the same result. Sink completions therefore agree and deterministic reconstruction gives the same factual projection. Channels outside this observation are not included in the proposition. □

Proposition 

(Representation and origin preservation at context use). Assume protected metadata cannot be constructed from candidate text, all active context inputs pass $\mathsf{UseOK}$, and every replacement of a mandatory cell carries a sound, current $\mathsf{RepOK}$ judgment for its consumer’s requirements. Then replacing exact cells by those representations preserves the declared coverage properties and cannot promote a textual approval into authority.

Proof. 

For an exact cell, the context theorem supplies the required input. For a replacement, its current preservation judgment transfers each required property or field interpretation from that cell to the representation. Origin and permitted use are checked from protected bindings, independently of the replacement text. Consequently a string claiming approval has no authority constructor. Induct over admitted insertions and replacements; deletion is permitted only if the remaining context still covers every mandatory dependency. A change in epoch or dependencies makes the corresponding old judgment unusable before the next invocation. The conclusion does not assert that a sound compressor for arbitrary input exists. □

11.6. Temporal Completion, Resources, and Replay

Proposition 

(Temporal and completion correspondence). If trusted event projection and the bound monitor soundly implement the specified temporal checks, admitted effects meet those checks, and a successful halt satisfies $D_j$ with no open mandatory stage duty or unresolved dependency.

Proof. 

Each admitted dispatch passes the monitor on its current verified history. Its correctness transfers that decision to the concrete event by the event-correspondence premise. Outcome propositions are introduced only through established outcomes, so unknown results cannot counterfeit a completed duty. At halt the explicit conjunction ${\mathsf{Complete}}_j$ is checked. Budget exhaustion has a different label and cannot satisfy that successful-halt rule. The statement does not infer eventual progress from blocking. □

Lemma 

(Resource conservation with unresolved work). Under serialized accounting and lifetime-dominating reservations,

$$S+\sum _{i\in R}{e}_i\le L$$

is invariant. Known charges satisfy $0\le c_i\le e_i$; unknown outcomes retain their reservation. Actual use is bounded by the same limit in the modeled additive dimensions.

Proof. 

The initial ledger satisfies the inequality. Reserve inserts only when the prospective sum is within L. Settlement changes the sum by $c_i-e_i\le 0$. A proved quiescent no-use release changes it by $-e_i$. Unknown outcome and lease expiry alone leave it unchanged. These are all ledger cases, so serialized induction proves the invariant. Completed actual use equals its settled charge; actual use of each still outstanding request is at most its retained lifetime bound. Summing gives actual use at most $S+\sum e_i\le L$. The argument applies componentwise. □

Theorem 

(Bounded classified kernel execution). With step fuel $B\in \mathbb{N}$, H5–H6 imply at most B positive-fuel kernel transitions followed, if needed, by one exhaustion transition. The invocation reaches success, declared failure, or uncertainty in finite time. No successful task completion or remote-process cancellation follows from this step bound.

Proof. 

Every positive-fuel step decreases a nonnegative integer by one. A terminal transition can occur sooner. If none does, zero enables the exhaustion rule and no positive-fuel rule. H6 makes local evaluation and the delivery of a result or deadline finite, so a pending wait cannot postpone classification forever. Unresolved external work remains represented after classification. □

Theorem 

(Strict replay determinism and nonexecution). Under H5 and complete fixed versions, state, and transcript, logical replay reconstructs the same states and events. Its external handler invocation count is zero, including on a miss.

Proof. 

For two replay runs, initial states agree. The same internal rule or next validated tagged event is supplied to the same total deterministic reducer, so the next logical states and event entries agree. Induction proves agreement of all consumed prefixes and terminal outcomes. The replay reducer substitutes stored observations and outcome transitions for dispatch; it has no live handler branch. A miss enters divergence rather than record mode. Consequently every case has zero external invocations. Equality concerns reconstructed state, not present external world state. □

11.7. Evolution, Determinacy, and Retained Authority

Theorem 

(Authorized evolution). If the only active-contract change rule requires issuer-policy authorization, checked $C^{\prime }$, and a sound migration witness, material changes cannot be caused by a model response or by retraction in construction state. A sequence of admitted epochs preserves each active epoch’s guarantees.

Proof. 

Inspect mutation paths: ordinary execution leaves C fixed, and candidate and construction-state revision have no active contract constructor. The activation rule is therefore the only case. Its authorization establishes the permitted change, its migration witness establishes the new good initial state and preserves pending obligations, and live capabilities/evidence are reissued or unavailable. Apply the within-epoch results from that state. Induction over activations composes the epochs. □

Proposition 

(Conditional observable determinacy). If a stage’s successful source traces are observable-determinate for the declared input and environment index, two successful conformant implementations agree under that observation.

Proof. 

Theorem 11.10 places both observations in the same successful source relation. Its determinacy property gives equality. Different permitted creative outputs demonstrate why safety and replay alone cannot supply this premise. □

Corollary 

(Delegation under retained intender authority). For an admitted contract whose ordinary control has no additional user-approval primitive, technical construction and execution require no fresh user authority at each step. Every later material contract change still follows the authorized activation rule. The existence of a successful artifact needs a construction witness or additional progress premise.

Proof. 

Every ordinary operation derives its authority from the checked contract, current evidence, and fixed admission rule. No transition case asks a model to create a grant or requires an undeclared human override. Theorem 11.20 governs the only material-change path. Successful construction is not implied by authority safety, as already shown by permitted all-failure traces. Section 12 supplies one nonempty witness. □

12. Reference Construction, Evidence, and Research Boundaries

12.1. An Explicit Token-Validation Contract

Consider an admitted local contract with integer inputs $(i,n,e)$, denoting issue time, supplied current time, and expiry, and Boolean output y. Its complete functional requirement is

$$G(i,n,e)\equiv (i\le n)\wedge (n<e),y=G(i,n,e).$$

The example explicitly binds both conjuncts. The phrase reject expired tokens alone would not establish every acceptance condition. Signature authenticity, clock accuracy, and unrelated token claims are outside this example contract. This is an explicit instantiation for the construction witness, not an inferred expansion of an unspecified user request.

The development contract fixes the writable validator module, protected acceptance artifacts, local-only effect scope, model interface, three proposal attempts, exact base binding, and stage predicates. The application contract describes a pure validator; it needs no model invocation. A profile binds comparison semantics and the restricted target language. There is no undeclared network grant in either contract.

12.2. An Explicit Formation Instance for the Witness

The restricted construction does not infer the two time conditions from an ambiguous phrase. Its source record contains the clauses $q_1:i\le n$, $q_2:n<e$, and $q_3:y\leftrightarrow (q_1\wedge q_2)$, with their authorized origins. The frontend’s restricted grammar admits those typed comparisons, Boolean conjunction, and a Boolean result. Elaboration constructs their SAST directly. Parsing and field attribution are structural; the source-fidelity premise concerns this explicit record.

A finite inventory requires both time clauses, their conjunction rule, the integer domain, the pure application-effect specification, and the development-scope profile. Each role is resolved from the pinned profile independently of supplied evidence. Omitting the expiry clause leaves that role undischarged; the checker does not silently change the contract to issue-time checking. A source that adds both $y=G$ and $y=\neg G$ is inconsistent over the nonempty integer input domain, as either Boolean value for G contradicts one equality. Search exhaustion is instead inconclusive.

The truth-table proof below is the local justification for the functional verifier. It does not rely on candidate code declaring itself correct. The fixed emitter’s four cases give its realization argument. The remaining concrete file-operation certificate still has to justify resource identity, protected artifacts, atomic base checking, and truthful outcomes. This instance closes its functional and structural obligations while keeping the actual filesystem adapter explicitly conditional.

12.3. A Fully Checked Candidate Domain

Let $L=[i\le n]$, $U=[n<e]$. Candidate programs are Boolean truth tables $t\in \{0,\dots ,15\}$ over these two atoms:

$$P_t(i,n,e)={\mathsf{bit}}_{2L+U}\left(t\right).$$

For indexing only, Boolean values are identified with 0 and 1. Bit positions are ordered $00,01,10,11$. A deterministic emitter realizes $P_t$ using two nested typed conditionals and Boolean literals. Thus the candidate is data for a closed code template, not arbitrary executable text. All 16 Boolean functions are represented. The exact verifier is

$$V\left(t\right)=\mathsf{ok}⟺\forall (a,b)\in {\{0,1\}}^2:{\mathsf{bit}}_{2a+b}\left(t\right)=a\wedge b.$$

Theorem 

(Universal functional correctness of admitted candidates). For every candidate t, $V\left(t\right)=\mathsf{ok}$ if and only if

$$\forall i,n,e\in \mathbb{Z}:P_t(i,n,e)=G(i,n,e).$$

The unique accepted truth table is $t=8$.

Proof. 

For soundness, each integer input induces one Boolean pair $(L,U)$. The verifier has checked that pair, hence $P_t(i,n,e)=L\wedge U=G(i,n,e)$. The nested-condition emitter selects exactly its indexed table bit, as four-case evaluation shows; it therefore realizes the same function.

For completeness, each Boolean pair is realized by an integer triple: at $n=0$, choose $(i,e)=(1,0),(1,1),(0,0),(0,1)$ for $00,01,10,11$, respectively. A program correct for every integer triple must therefore have table vector $(0,0,0,1)$ in the declared ordering: only bit 3 is set. Its integer encoding is 8, which the verifier accepts. This also proves existence and uniqueness without a model-quality assumption. □

12.4. Construction, Effects, and Completion

The checked development control is: read the pinned snapshot and task slice; request a candidate; decode and check it; check the concrete patch footprint and protected artifacts; apply under a fresh base identity; record an outcome; then evaluate the completion stage. Incorrect or malformed proposals take the bounded repair edge. A definite no-effect application failure can retry under the same limit; an unknown effect terminates as unknown.

The full act guard additionally requires permitted resources, current capability and dependency versions, required prior verification, and a matching handler descriptor. The functional verifier does not replace those guards. A patch outside the writable module, a forged capability string, a stale base, or a receipt for a different request cannot satisfy them.

With candidate $t=8$, adequate declared resources, unchanged dependencies, and a conformant successful local effect, the construction reaches an application satisfying the universal functional requirement. This is a nonempty successful realization, not only an all-failure-safe specification. If no correct candidate appears within the bounded attempts, the classified result is failure. A strategy guaranteeing that a correct candidate appears is an additional synthesis property.

The constructed application can execute without a separate SCL interpreter: its fixed typed comparisons and conditionals realize $C_A$, while the development-time checks belong to $C_B$. This witnesses the distinction between construction assistance and application inference. The intender need only supply or authorize the declared commitments; no source edit by the intender is a premise of this witness.

12.5. Executed Finite Consistency Check

An independently written structured reference runner and a program-counter runner were executed over every padded three-attempt stream from the alphabet

$$\{-2,-1,0,\dots ,15\}\times \{0,1,2\}.$$

The first component is timeout, malformed response, or a truth-table candidate. The second component is success, certified no effect, or unknown act outcome. Outcomes attached to attempts without an act, and suffixes after termination, are unused padding. These are not independent benchmark tasks or samples from a model distribution.

The two runners agreed on the complete semantic event list and terminal status for all ${54}^3=157,464$ padded streams. A separate trace inspector checked that every act used $t=8$, that every success ended in the successful receipt, and that the outstanding reservation remained present on unknown outcomes. Synthetic call-unit use stayed within six: at most three model invocations and three act invocations, each bounded by one unit. These are technical accounting units, not real-provider measurements.

Finite check item	Observed count
Padded streams compared	157,464
Failure classification	140,608
Success classification	8,428
Unknown classification	8,428
Integer test evaluations of candidate functions	2,000
Accepted truth-table encodings	1

The additional integer check used the 125 triples from ${\{-2,-1,0,1,2\}}^3$ for each of the 16 functions; only table 8 passed. Theorem 12.1, rather than that finite enumeration, establishes correctness for every integer triple.

The finite comparison checks the reference control’s lowering and selected accounting cases.

12.6. Counterexamples Defining the Protection Boundary

The following cases explain why the hypotheses are necessary:

1.

Missing source commitment. Two contracts can both satisfy a vague storage request while selecting different data destinations. Type safety cannot choose the intended destination.

2.

Forged evidence representation. If ordinary JSON could construct a capability or evidence token, a malicious candidate could bypass checking. Constructor opacity is therefore a concrete implementation obligation.

3.

Controller-only commit. A tool may send data and then fail a controller-state check. Rejecting its state patch does not retract the disclosure.

4.

Stale snapshot. Evidence for base v cannot authorize applying a patch to changed base $v^{\prime }$ without revalidation or a valid dependency relation.

5.

Budget expiry without quiescence. Releasing an outstanding reservation while its request can still consume resources can exceed the cap when replacement work starts.

6.

Incomplete replay. Identical model text with a different unrecorded database answer can take a different branch.

7.

Always-fail realization. A safe implementation can return a permitted failure for every input. This disproves an inference from safety or trace inclusion to successful synthesis.

8.

Unchecked summary. Two source commitments can be compressed to the same summary while differing on a required prohibition. Summary equality alone cannot prove obligation coverage.

12.7. Problem-to-Result Accountability

Unresolved specification.

Structural diagnostics and provenance prevent silent authorization within the declared profile. Full natural-language fidelity remains a separate source obligation.

Erroneous generation.

Candidate confinement and sound admission prevent an arbitrary response from creating authority. Universal functional correctness is obtained when its specific verifier is sound, as in Theorem 12.1.

Constraint loss.

The context theorem preserves declared mandatory dependencies; release confinement prevents unapproved factual persistence. Correct model use and completeness of dependency discovery are not inferred.

Unauthorized effects.

The authority theorem covers every mediated effect, with real-state preservation conditional on local handler certificates and interference assumptions.

Unbounded control and false completion.

Fuel and deadlines provide classified termination; completion checks retain duties and goals.

Model and backend dependence.

Substitution preserves authority under the same adapter interface; replay requires the full external transcript. Backend quality and efficiency remain measurable properties.

Intender-centered construction.

The delegation corollary and nonempty construction witness establish the technical division of labor under explicit commitments.

12.8. Implementation Conformance and Empirical Evaluation

An implementation must supply witnesses for operation closure, opaque tokens, complete effect mediation, sound evidence binding, atomic freshness, target abstraction, unresolved outcomes, resource enforcement, context coverage, and replay encoding. Framework names do not determine conformance.

A controlled evaluation should compare contract violations, successful task completion, false rejection, context-obligation loss, and complete construction-plus-execution resource use.

Building upon this theoretical foundation, future work will address practical deployment, including a full SCL implementation and empirical measurements of energy efficiency and synthesis capabilities.