ARCADIA-Studio/harness/analysis-public-read-contract-20260925.md

Public read-only mixed source8 validation

Baseline 7b06b8ea1b7ef902ee0b3d0ec2971a9a7a1f1acd, local-only while Gitea publication is blocked. This bounded outcome advances the user's textual linting and programmatic model requirements without claiming application editing parity. The implementation map and independent critique compare diagnostics-only, borrowed, owned and full editable-compilation alternatives. The acceptance review pins independent fixture, model, warning and boundary-diagnostic oracles.

Selected interface and authority

Expose only language::check_mixed_bundle(&SourceBundle, ProjectLimits) returning Result<language::CheckedMixed<'_>, Vec<SourceDiagnostic>>. The opaque, non-Clone result offers project() -> &Project and warnings() -> &[SourceDiagnostic]. Define it beside the existing resolved owner and re-export the type/function through private modules. Keep its fields and constructor private. It directly retains the actual ResolvedMixedProject; no model substitution or second parse.

The result borrows the actual complete input bundle for its lifetime. It grants validation and immutable queries, not an editable source index, stabilized output, save authority, ownership extraction or history installation. Preserve the real syntax/expression/occurrence/storage owners while the witness lives. Do not add unused public methods, artificial runtime reads or broad lint suppression merely to accommodate retained internal fields.

Accept only schema8 with explicit UUIDs for project, every ordinary and typed declaration, and typed parameters. Preserve canonical logical paths, include traversal and detached-file rejection. Return complete admitted OA/SA models and actual located warnings in existing order; errors return no partial successful result. Preserve exact original bytes, comments and line endings. No missing-ID generation, migration, filesystem discovery, formatter or write operation occurs. Use clear public diagnostics for the schema/explicit-ID requirements rather than describing the supported API as private test machinery.

Policy and production dependency boundary

Construct fresh borrowed C=0 authority from the actual bundle and caller policy. Derive internal Limits once by the existing source8 formula: caller source-byte and step-reference limits, remaining ParseLimits fields UNLIMITED. Internal entries therefore remain capped at262144 independently of caller model records; the latter still governs actual final-model admission. Keep the existing hard token, frame, numeric, byte and reference ceilings. Do not expose an arbitrary profile or raw Slots constructor. Preserve Some(Borrowed) and select both text and entry producers, then complete resolution/admission with the same policy.

Promote only the required parse/lower/resolve dependency cone. Parser mixed state and shared helpers must compile in production coherently while existing ordinary callers still select None. Keep private edit/index/emission machinery, fixture constructors, retained snapshots and Pending-backed authority under cfg(test). Use item-level gating from the reviewed map. Necessary retained allocation or admission-evidence fields may have individually documented non-test dead-code allowances; do not suppress whole modules/structs or weaken -D warnings.

This remains the existing logical storage policy, not an all-heap/RSS guarantee. Independently bounded traversal, delimiter/Pratt/duplicate-name scratch and established model/validator/numeric internals retain their documented scopes. Preserve generic depth64, typed depth128, DEPTH_128_VALIDATED=false and the unresolved full-pipeline small-stack limitation. Linux remains user-deferred.

Observable acceptance

• A real non-test integration consumer uses the exported API on substantial OA and SA multi-file fixtures with independently authored complete model oracles, located warnings, nested ownership, cross-file/scoped references and Unicode/CRLF. Reuse valid authored fixtures/oracles without deriving expected models from the candidate parser or writer. Check all original bytes on success/refusal.
• Negative cases cover missing UUIDs in each required class, unsupported versions, invalid paths/includes/cycles/detached files, malformed and duplicate/unresolved or wrong-kind references. Assert actual diagnostic paths/spans and meaningful error categories. Keep long ordinary analysis-constructor rejection explicit.
• Prove the real production constructor selects borrowed zero carry, both producer modes and every derived limit through narrow internal observation; preserve existing discriminating producer cap tests. Public tests exercise caller source, file, edge/depth and final-model/step restrictions. The minimal78-byte fixture reaches input admission before its C0 text44/43 boundary, so do not mislabel a source-byte rejection as a producer-boundary test or reuse pending O152/151 caps. Preserve existing diagnostic mapping and phase precedence: the early byte check reports invalid_source with Source8 index/output byte limit exceeded., not Traversal's later source_limit. Use the reviewed exact spans/categories for file, edge and depth boundaries rather than assuming a uniform limiter layer.
• Compile-fail documentation demonstrates that the result cannot outlive or permit mutation of its source. Include a concise real usage example and public API documentation in the established language documentation; distinguish this bounded read contract from full source8 editing and application support.
• Run core library, the new non-test integration target, relevant existing ordinary integration/stack controls, doctests, strict core all-target Clippy and formatting disposition. Production Parser layout now includes mixed state: previously test-only success is insufficient to qualify ordinary non-test callers. Investigate concrete stack/runtime changes; no larger stack or relaxed budgets. Reuse other valid evidence only when component inputs are unchanged.

Existing parse/compile, source-file loader, CLI, desktop, server, formatting, update, save and history contracts remain separate. Current CLI discovery parses ordinary syntax and unconditionally constructs editable compilation even for Check; a new Rust API alone cannot enable mixed CLI checking. Reject a fake index, regex include scanner or nominal command that fails before this checker. A later CLI/discovery adapter or full editing adoption requires its own concrete outcome.

Parent owns compiler execution, synthesis, acceptance and publication. Bounded implementation and independent source/oracle review may proceed on a distinct local branch; no shared ownership or publication success is implied by this contract while Gitea writes remain unavailable.