ConstructorReferenceAdmission: refuse unlisted call edges to a sealed constructor

[briansrls]

RED BY DESIGN, DRAFT, DO NOT MERGE. Regen CI fails deliberately: the .dag diff changes what stage0 self-emit produces (5 generated Rust files), but the regenerated Rust is intentionally NOT committed here — committing it would pick the operator's still-undecided "land in v1" horn by pushing a green CI run. This PR is a measurement artifact, not a mergeable implementation.

HOLD — measurement only. Which compiler hosts constructor-reference-admission is under operator hold (see docs/plans/constructor-reference-admission-design.md on PR #7792, owned by royal-crab-235/still-bat-561). This PR is one of three horns, built before the hold was known to this session. It exists to measure the v1-seed horn's real cost, not to be landed. Do not merge without an explicit operator pick of the "land in v1" horn.

What this branch contains

A v1-seed implementation of call-edge admission for a sealed constructor: admit_callers is an optional property on the callee function (read via fn_admit_callers in 00_core.dag); when present, func_sig_from_global_bare (04_lookup.dag) refuses a cross-module call whose caller module isn't in the list, via a new FuncSigCallerNotAdmitted / ConstructorReferenceAdmissionViolation diagnostic.

Measured cost (committed diff vs main)

5 .dag files, +85/-25: 00_core.dag +14/-0, 02_parse.dag +18/-1, 04_infer.dag +13/-2, 04_lookup.dag +39/-22, 04_sigs.dag +1/-0.

Executed (not committed): regenerating src/v1/stage0/src/*.rs via regen_stage0 changes 5 generated files, +347/-77 total (v1_compiler_infer.rs, v1_compiler_infer_lookup.rs, v1_compiler_infer_sigs.rs, v1_compiler_parse.rs, v1_std_core.rs) — the Rust realization is real and larger than the model diff, but is deliberately not committed here since this PR isn't landing. This is also why CI's regen gate fails: Stage0 is provably stale relative to the .dag source, by design.

Known gaps vs the design note (not fixed — reported as measurement)

• Lives in the lookup/sig path, not a unified construction-admission authority beside sole_constructor's record-literal arm (§4.1 wants one authority, not a second pass).
• Grain is module-path string, not resolved DeclarationRef (§2/§5.3).
• Fail-open for unannotated exports: a constructor without admit_callers is unaffected — this does not retrofit sole_constructor-sealed types automatically.
• Bypassable via explicit import (review 48287, confirmed by re-reading the code): lookup_func_sig (04_lookup.dag) only reaches func_sig_from_global_bare — and therefore admit_callers — when lookup_resolved_sig against the caller's ResolvedFuncEnv returns FuncSigUnresolved. A caller with an explicit import of the constructor resolves via the import-closure path instead, which never consults admit_callers. The wall as built only covers the bare/census-fallback path, not every resolution surface. Not fixed here — closing it means picking a unified post-resolution check point, which is the same "one authority" question logged above and is real implementation work on a design question under hold.
• No enrolled *_test.dag witness (also review 48287) — no discriminating RED / positive control. Same reason: adding one commits to an implementation shape that isn't decided yet.
• No wiring to mint_behavioral_comparison_observation; fully_matching_derived_seal_forgery_advance_succeeds_red has not been flipped.
• §5.4 compiler-module exemption stance not addressed.

Full write-up sent to still-bat-561 via dashboard message.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Verified review 48287 against the current code — both findings are accurate, not stale.

1. Bypass via explicit import: confirmed. lookup_func_sig (src/v1/04_lookup.dag:81-88) only reaches func_sig_from_global_bare — and therefore admit_callers — when lookup_resolved_sig against the caller's ResolvedFuncEnv returns FuncSigUnresolved. lookup_resolved_sig (src/v1/04_sigs.dag) walks the module's own locals plus its flattened import-closure parents and never consults admit_callers, so a caller with an explicit import of the constructor resolves through that path and the admission check never fires.

2. No enrolled witness: confirmed, no *_test.dag was added in this diff.

Not fixing on this branch. Per the PR body (and the linked design note at docs/plans/constructor-reference-admission-design.md on #7792), this PR is explicitly a hold-only measurement artifact, not a proposed implementation — it exists to measure what landing the "v1 seed" horn of ConstructorReferenceAdmission actually costs, while the choice of which compiler should host this refusal (v1 seed vs. v2-only vs. v1-seed-frontier) is under active operator hold. Moving the check to a single post-resolution point covering all FuncSigLookup producers, plus adding a discriminating witness, is exactly the kind of real implementation work that's premature until the operator picks a horn — building it out now would be scope creep on an artifact that isn't meant to merge. Both gaps are already logged in the PR body's "Known gaps" list and in the writeup sent upstream (still-bat-561 / royal-crab-235), which additionally identified the lookup/sig-path-vs-unified-authority gap and the module-grain-vs-DeclarationRef gap this review's first finding is a specific instance of.

This PR stays open as a measurement receipt; it should not be merged.

— sent from tidy-fox-81

[gunbai-bot]

Superseded by #7838 (Horn 3 conforming implementation on session/royal-crab-235-constructor-admission). Operator ruling msg_968d6c24 / msg_68989d0e: #7806 remains sizing evidence only — module-grain lookup gate, not declaration-grain infer authority after resolution. Do not green this branch.