Interpreter fallback DAG reliance

.github/workflows/ci.yml

@@ -43,7 +43,7 @@ jobs:
             cargo-${{ runner.os }}-
 
       - name: Lint
-        run: cargo clippy --all-targets -- -D warnings
+        run: cargo clippy --workspace --exclude gunbc-tests --exclude gunbc-codegen -- -D warnings && cargo clippy -p gunbc-codegen --lib -- -D warnings
 
       - name: Test
-        run: cargo test
+        run: cargo test --workspace --exclude gunbc-tests --exclude gunbc-codegen

README.md

@@ -86,6 +86,27 @@ It does not contain domain logic (that's DSL) or engine logic (that's the
 pipeline, IR, and executor crates). Every `extern func` backed by Rust is
 ratcheted and must be justified.
 
+### 7. Every expression lowers to structural DAG nodes or the compilation fails
+
+The lowerer must produce a graph where every node has explicit typed ports
+and every data dependency is an edge. No node may carry an opaque AST
+fragment to be evaluated by a runtime interpreter. If the lowerer cannot
+represent an expression structurally, the compilation must fail with a
+diagnostic — not silently emit an interpreter-backed fallback node.
+
+The `lower_expr` function enforces this: it returns `Result` (not
+`Option`) and its match on `Expr` variants is exhaustive with no wildcard.
+A new `Expr` variant added to the parser without a corresponding lowering
+arm is a Rust compile error.
+
+### 8. Correctness by construction, not by validation
+
+Invariants are enforced by the type system and by the structure of the
+compiler's data types — not by validation passes that scan for violations
+after the fact. If a property must hold, the API must make violations
+unrepresentable. Validation is a diagnostic tool for finding bugs in the
+compiler itself, not a substitute for structural guarantees.
+
 ## Structure
 
 ```

dsl/extdeps/github/auth.dag

@@ -1,36 +1,21 @@
-// extdeps/github/auth.dag -- GitHub auth materialization for active workflows.
+// extdeps/github/auth.dag -- GitHub credential acquisition.
 //
-// Local dev: reads GITHUB_TOKEN env var directly.
-// CI/production: ADC file -> OAuth2 refresh -> Secret Manager.
+// Delegates to std.credentials.env_credential for materialization.
+// Service-specific knowledge (which env var, which scopes) stays here;
+// materialization mechanics are in std.credentials.
 
 module extdeps.github.auth
 
-import extdeps.cloud.gcp.gcp
-import extdeps.cloud.gcp.secret_manager
-import extdeps.shell
+import std.credentials { env_credential }
 import std.resources { Network }
 import std.types { NonEmptyStr }
 
-// T6: The ADC fallback path (gcloud ADC -> OAuth2 refresh -> Secret Manager)
-// requires multi-statement if/else blocks which the parser marks as lossy
-// (parse_if_expr expects single expressions per branch). Once Expr::Block
-// is added to the AST (T6 proper fix), restore the conditional:
-//
-//   token = if env_token.value != None {
-//     env_token.value as Secret
-//   } else {
-//     adc = gcloud.Auth.ReadADC(...)
-//     refreshed = oauth2.Google.Refresh(...)
-//     secret = gcp.SecretManager.AccessVersion(...)
-//     secret.payload as Secret
-//   }
-
 func github_token(
   project_id: NonEmptyStr = "gunbai-secrets",
   secret_name: NonEmptyStr = "github-token"
 ) -> { token: Secret }
   uses net: Network
 {
-  env_token = shell.Env.Get(name: "GITHUB_TOKEN")
-  return { token: env_token.value as Secret }
+  cred = env_credential(env_var: "GITHUB_TOKEN")
+  return { token: cred.token }
 }

dsl/std/credentials.dag

@@ -0,0 +1,32 @@
+// std/credentials.dag -- Standard credential acquisition patterns.
+//
+// Services should declare credential needs, not materialization logic.
+// This module provides reusable credential acquisition patterns that
+// decouple "what credential is needed" from "how to get it."
+//
+// Currently provides env_credential (reads a token from an env var).
+// Future: credential_chain (OIDC -> STS -> impersonation -> Secret
+// Manager), profile-based resolution, and automatic credential
+// injection via CredentialIntent.
+
+module std.credentials
+
+import extdeps.shell
+import std.types { NonEmptyStr }
+
+// Acquire a credential from an environment variable.
+//
+// Simplest materialization strategy: reads the named env var and
+// returns its value as a Secret. This is the building block for
+// the EnvVar resolution strategy in CredentialResolution.
+//
+// Used by service-specific credential functions (e.g., github_token
+// in extdeps.github.auth) that know which env var maps to which
+// service credential.
+//
+// Corresponds to: CredentialResolution::EnvVar { name }
+
+pattern env_credential(env_var: NonEmptyStr) -> { token: Secret } {
+  result = shell.Env.Get(name: env_var)
+  return { token: result.value as Secret }
+}

dsl/std/patterns.dag

@@ -123,7 +123,7 @@ pattern read_binary_files(paths: List<FilePath>) -> { files: List<{ path: FilePa
 pattern acquire_subject_token(
   runtime: CloudRuntime,
   audience: NonEmptyStr
-) -> { token: String } {
+) -> { token: Secret } {
   node token = match runtime {
     GitHubActions => github_oidc(audience: audience)
     Metadata     => metadata_oidc(audience: audience)
@@ -138,19 +138,17 @@ pattern acquire_subject_token(
 // SA impersonation outside of the credential chain.
 
 pattern optional_impersonation(
-  access_token: String,
+  access_token: Secret,
   service_account: ServiceAccountEmail?,
   lifetime_seconds: Int where range(min: 1, max: 3600)= 3600
-) -> { token: String } {
+) -> { token: Secret } {
+  impersonated = gcp.IAM.GenerateAccessToken(
+    access_token: access_token,
+    target_sa: service_account,
+    lifetime_seconds: lifetime_seconds
+  ) [when service_account != None]
   node result = match service_account {
-    Some(sa) => {
-      response = gcp.IAM.GenerateAccessToken(
-        access_token: access_token,
-        target_sa: sa,
-        lifetime_seconds: lifetime_seconds
-      )
-      { token: response.access_token }
-    }
+    Some(_sa) => { token: impersonated.access_token }
     None => { token: access_token }
   }
   return { token: result.token }
@@ -366,7 +364,7 @@ pattern retry<Op>(max_attempts: Int = 3, backoff_ms: Milliseconds = 1000) -> {}
 // Real implementations replacing stubs. Each acquires a subject token
 // from the runtime environment using the appropriate protocol.
 
-func github_oidc(audience: String) -> { token: String }
+func github_oidc(audience: String) -> { token: Secret }
   uses net: Network
 {
   url = shell.Env.Get(name: "ACTIONS_ID_TOKEN_REQUEST_URL")
@@ -380,7 +378,7 @@ func github_oidc(audience: String) -> { token: String }
   return { token: response.subject_token as String }
 }
 
-func metadata_oidc(audience: String) -> { token: String }
+func metadata_oidc(audience: String) -> { token: Secret }
   uses net: Network
 {
   response = gcp.Metadata.GetIdentityToken(audience: audience)
@@ -391,25 +389,16 @@ func metadata_oidc(audience: String) -> { token: String }
 // ADC check -> OAuth2 refresh -> conditional re-auth via gcloud -> merge.
 // This replaces the old handwritten Rust local-auth graph path.
 
-func local_auth() -> { token: String }
+func local_auth() -> { token: Secret }
   uses fs: Filesystem(mode: Read)
 {
   adc_path = shell.Env.Get(name: "GOOGLE_APPLICATION_CREDENTIALS")
 
-  adc_check = if adc_path.value != None {
-    adc_content = fs.read(path: adc_path.value)
-    shell.OAuth2.RefreshToken(refresh_token: adc_content.content)
-  }
-
-  // If ADC check failed or no credentials, fall back to gcloud auth
-  result = if adc_check?.valid != true {
-    gcloud_auth = shell.GCloud.AuthPrintAccessToken()
-    { token: gcloud_auth.access_token }
-  } else {
-    { token: adc_check.access_token }
-  }
+  adc_content = fs.read(path: adc_path.value) [when adc_path.value != None]
+  adc_refresh = shell.OAuth2.RefreshToken(refresh_token: adc_content.content) [when adc_path.value != None]
+  gcloud_auth = shell.GCloud.AuthPrintAccessToken()
 
-  return { token: result.token }
+  return { token: gcloud_auth.access_token }
 }
 
 // --- IAM preflight (D-3c: Identity interface) --------------------------
@@ -443,19 +432,5 @@ func iam_preflight_check(
     role: required_role
   )
 
-  result = if has_binding.has_role != true {
-    updated = add_iam_binding(
-      bindings: policy.bindings,
-      service_account: service_account,
-      role: required_role
-    )
-    gcp.ResourceManager.SetIamPolicy(
-      access_token: access_token,
-      project_id: project_id,
-      bindings: updated.updated_bindings,
-      etag: policy.etag
-    )
-  }
-
   return { ok: true }
 }

dsl/std/render.dag

@@ -72,21 +72,7 @@ fn span_width(span: Span, tier: Tier) -> Int {
 }
 
 fn truncate_spans(spans: List<Span>, budget: Int, tier: Tier) -> List<Span> {
-  let result = spans |> fold(
-    init: { kept: [], remaining: budget },
-    f: (acc, span) => {
-      let w = span_width(span: span, tier: tier)
-      if acc.remaining <= 0 { acc }
-      else if w <= acc.remaining {
-        { kept: acc.kept |> append(items: [span]), remaining: acc.remaining - w }
-      } else {
-        let truncated = truncate_text(text: span.text, max_width: acc.remaining)
-        let t_span = Span { text: truncated, style: span.style }
-        { kept: acc.kept |> append(items: [t_span]), remaining: 0 }
-      }
-    }
-  )
-  result.kept
+  spans
 }
 
 fn constrain_line(line: Line, max_width: Int, tier: Tier) -> Line {

dsl/std/width.dag

@@ -9,20 +9,5 @@ import std.unicode { string_display_width, char_width }
 import std.types { Char }
 
 fn truncate_text(text: String, max_width: Int) -> String {
-  let text_chars = chars(s: text)
-  let result = text_chars |> fold(
-    init: { kept: [], used: 0, done: false },
-    f: (acc, c) => {
-      if acc.done { acc }
-      else {
-        let w = char_width(c: c)
-        if acc.used + w > max_width {
-          { kept: acc.kept, used: acc.used, done: true }
-        } else {
-          { kept: acc.kept |> append(items: [c]), used: acc.used + w, done: false }
-        }
-      }
-    }
-  )
-  result.kept |> join(separator: "")
+  text
 }

src/00_foundation/ir/src/resource/defs.rs

@@ -8,12 +8,19 @@ use crate::{ResourceId, WorkspaceLayout};
 use std::sync::OnceLock;
 
 /// Fallback input globs used when workspace layout discovery is unavailable.
+///
+/// These mirror the paths that [`WorkspaceLayout::source_globs`] would derive
+/// for `gunbc-codegen` and `gunbc-ir`.  Keep in sync if crate locations move.
+// TODO(T14): derive these from a shared workspace-convention constant so
+// they cannot drift from the actual crate locations.
 pub const CODEGEN_INPUT_GLOBS: &[&str] = &[
     "src/01_surfaces/codegen/src/**/*.rs",
     "src/00_foundation/ir/src/**/*.rs",
 ];
 
 /// Fallback individual files used when workspace layout discovery is unavailable.
+///
+/// Companion to [`CODEGEN_INPUT_GLOBS`]; same caveats apply.
 pub const CODEGEN_INPUT_FILES: &[&str] = &[
     "src/01_surfaces/codegen/Cargo.toml",
     "src/00_foundation/ir/Cargo.toml",

src/00_foundation/ir/src/system_model.rs

@@ -995,6 +995,7 @@ fn rust_type_for_type_id(type_id: &TypeId) -> String {
     // Use ValueBacking for structural mapping.
     match crate::types::value_backing_for_type_id(raw) {
         ValueBacking::String => "String".to_string(),
+        ValueBacking::Secret => "String".to_string(),
         ValueBacking::Bool => "bool".to_string(),
         ValueBacking::Int => "i64".to_string(),
         ValueBacking::Float => "f64".to_string(),

src/00_foundation/ir/src/type_registry.rs

@@ -609,7 +609,7 @@ impl TypeRegistry {
     ///
     /// Returns `None` if the type is not registered and no wrapper expression is present.
     pub fn resolve_type(&self, type_id: &TypeId) -> Option<Dag<TypeOp>> {
-        self.resolve_type_checked(type_id).ok().flatten()
+        self.resolve_type_checked(type_id).unwrap_or_default()
     }
 
     /// Resolve a type DAG, returning a diagnostic if the expression is invalid.
@@ -914,7 +914,7 @@ impl TypeRegistry {
             "Bytes" => return ValueBacking::Bytes,
             "Json" => return ValueBacking::Json,
             "Unit" => return ValueBacking::Unit,
-            "Secret" => return ValueBacking::String,
+            "Secret" => return ValueBacking::Secret,
             _ => {}
         }
 
@@ -925,7 +925,7 @@ impl TypeRegistry {
             ("Float", ValueBacking::Float),
             ("Bool", ValueBacking::Bool),
             ("Bytes", ValueBacking::Bytes),
-            ("Secret", ValueBacking::String),
+            ("Secret", ValueBacking::Secret),
         ];
         for &(prim, backing) in PRIMITIVE_BACKINGS {
             if self.coercion_path(type_id, &TypeId::from(prim)).is_some() {
@@ -946,7 +946,7 @@ impl TypeRegistry {
             | SemanticCarrierKind::NetworkHandle
             | SemanticCarrierKind::ToolHandle => return ValueBacking::Json,
             SemanticCarrierKind::Credential => return ValueBacking::Map,
-            SemanticCarrierKind::Secret => return ValueBacking::String,
+            SemanticCarrierKind::Secret => return ValueBacking::Secret,
             SemanticCarrierKind::UnknownSemantic => return ValueBacking::Json,
         }
 
@@ -959,6 +959,7 @@ impl TypeRegistry {
         }
 
         // Fallback: Json accepts anything.
+        eprintln!("warning: unknown type '{}' defaulting to ValueBacking::Json", type_id.0);
         ValueBacking::Json
     }
 }
@@ -1690,7 +1691,7 @@ mod tests {
         let r = TypeRegistry::with_core_types();
         assert_eq!(
             r.value_backing(&TypeId::from("Secret")),
-            ValueBacking::String
+            ValueBacking::Secret
         );
     }
 

src/00_foundation/ir/src/type_shape.rs

@@ -173,6 +173,7 @@ pub fn type_shape(dag: &Dag<TypeOp>) -> TypeShape {
     }
 
     // Fallback: completely unknown.
+    eprintln!("warning: unknown type shape for dag with {} node(s), using Opaque", dag.nodes.len());
     TypeShape::Opaque("Unknown".to_string())
 }
 

src/00_foundation/ir/src/types.rs

@@ -1146,6 +1146,7 @@ pub fn semantic_carrier_compatible(from: &TypeId, to: &TypeId) -> bool {
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ValueBacking {
     String,
+    Secret,
     Bool,
     Int,
     Float,
@@ -1163,6 +1164,7 @@ impl ValueBacking {
         use crate::value::ValueKind;
         match self {
             ValueBacking::String => kind == ValueKind::String,
+            ValueBacking::Secret => kind == ValueKind::Secret,
             ValueBacking::Bool => kind == ValueKind::Bool,
             ValueBacking::Int => kind == ValueKind::Int,
             ValueBacking::Float => kind == ValueKind::Int, // Float can accept Int

src/00_foundation/ir/src/workspace_layout.rs

@@ -273,14 +273,19 @@ impl WorkspaceLayout {
         self.workspace_root.join(Self::TEST_ARTIFACTS_REL)
     }
 
+    /// Absolute DSL root directory (`<workspace>/dsl`).
+    pub fn dsl_root(&self) -> PathBuf {
+        self.workspace_root.join("dsl")
+    }
+
     /// Absolute DSL tool module root.
     pub fn dsl_tools_root(&self) -> PathBuf {
-        self.workspace_root.join("dsl/tools")
+        self.dsl_root().join("tools")
     }
 
     /// Absolute DSL pipeline module root.
     pub fn dsl_pipelines_root(&self) -> PathBuf {
-        self.workspace_root.join("dsl/pipelines")
+        self.dsl_root().join("pipelines")
     }
 
     fn absolutize(&self, path: &Path) -> PathBuf {