research: rebuild RBC 1.3 DOMAIN_CALL as evidence-gated native organ ABI

[xingxuling]

Goal

Rebuild the useful part of the stale agent/advanced-runtime-rcl RBC 1.3 / DOMAIN_CALL experiment on top of current main, without merging the stale branch, copying its binaries, hard-wiring all 18 old builtins into the canonical VM, or laundering experimental execution into a native claim.

Progresses #38. This PR remains deliberately Draft / CANDIDATE.

Architectural decision

The stale branch's 18-builtin VM table is rejected as the target architecture. The replacement is an external, evidence-gated Domain Organ model:

historical semantic candidate
→ operation-scoped differential
→ native-candidate organ
→ RBC 1.3 opcode 45
→ Domain Value ABI
→ external C organ
→ candidate VM materialized from current native/rclvm.c
→ native-process differential + semantic-root replay
→ native-verified organ
→ separate canonical admission decision

Four admitted operations

Only four historical operations have reconstructable reference semantics and are allowed out of quarantine in this slice:

• core.echo
• quantity.make
• quantitative.measure
• knowledge.claim

The other 14 historical native-only operations remain quarantined.

Implemented in this PR

Candidate RBC 1.3

src/rbc13-domain-bytecode-candidate.mjs materializes experimental RBC 1.3 / opcode 45 in literal and dynamic dispatch modes. Candidate arguments support Number, Truth, Text, recursive Sequence and { $state: "path" } references.

Canonical src/bytecode.mjs remains unchanged and does not emit opcode 45.

Evidence-tiered Domain Organ model

src/domain-operation-organ.mjs defines the non-compensatory lifecycle:

quarantined → differential-verified → native-candidate → native-verified

Registration, implementation, native verification and canonical admission are separate gates.

Stable native value membrane

native/rcl_domain_value.h/.c defines an owned, bounded ABI for Null / finite Number / Truth / Text / Sequence / typed Record. It includes deep clone/free, recursive validation, duplicate-field rejection and bounded recursion/items/text.

native/rcl_domain_vm_value_bridge.inc converts the admitted current VM Value subset to/from Domain Values without exposing the private VM heap layout to external organs.

External native organ registry

native/rcl_domain_organ.h/.c provides a bounded registry with owned identity strings and minimum evidence-tier checks before invocation.

Its error channel is now structured (code + message) rather than a single opaque string.

Semantic error preservation

The candidate VM owns dynamically supplied error codes and forwards Domain Organ semantic failures directly instead of wrapping every failure in RCL_NATIVE_DOMAIN_ORGAN_FAILURE.

The first four C candidates align tested current-JS failure identity, including:

• unknown quantity type → TypeError;
• measurement type → RCL_MEASUREMENT_TYPE;
• measurement uncertainty → RCL_UNCERTAINTY_TYPE;
• measurement confidence → RCL_CONFIDENCE_RANGE;
• knowledge type → RCL_KNOWLEDGE_TYPE;
• knowledge confidence → RCL_KNOWLEDGE_CONFIDENCE_RANGE.

RCL errors retain the same code-prefixed message form as the current RCLError hierarchy. Native differential adapters reconstruct the same semantic details object from operation inputs so error observations can actually match, not merely share a headline code.

Current-source candidate VM materialization

scripts/materialize-rbc13-domain-vm-candidate.mjs transforms the checked-out native/rclvm.c at test/runtime-materialization time. It adds experimental RBC 1.3/opcode45 support, the Domain Organ registry, structured error forwarding and the VM↔Domain Value membrane while preserving RBC 1.1/1.2 compatibility.

The checked-in canonical native/rclvm.c is not modified.

scripts/materialize-rbc13-domain-vm-public-api.mjs additionally exposes a candidate host ABI through native/rcl_domain_vm_candidate.h:

• rclvm_instance_register_domain_organ
• rclvm_instance_set_domain_minimum_tier
• rclvm_instance_domain_organ_count
• rclvm_instance_domain_minimum_tier

The candidate VM defaults to requiring native-verified; experimental hosts must explicitly lower that gate to execute a native-candidate.

Four external C candidates

native/rcl_domain_admitted_organs.c implements:

• core.echo
• quantity.make
• quantitative.measure
• knowledge.claim

They remain candidate implementations until promotion evidence exists.

Operation-scoped semantic differentials

src/rbc13-domain-operation-differential.mjs gives every admitted operation its own current/reference cases, deterministic replay and mutation control instead of issuing one aggregate certificate to all four operations.

src/rbc13-domain-organ-candidate-plan.mjs binds a passed operation differential to its named C candidate while keeping artifact binding and native promotion pending.

Separate Domain Organ Native Promotion protocol

The existing canonical native-capability-promotion.mjs is intentionally left unchanged because it assumes canonical RCL source → canonical RBC.

Experimental opcode45 uses a parallel strict gate:

• src/rbc13-domain-native-runtime.mjs
• src/rbc13-domain-native-promotion.mjs
• scripts/run-rbc13-domain-native-promotion.mjs
• tests/rbc13-domain-native-promotion.test.mjs
• docs/RBC13_DOMAIN_NATIVE_PROMOTION_PROTOCOL_v0.1.md

Per operation, promotion requires:

1. operation-scoped semantic differential eligibility;
2. deterministic RBC 1.3 bytes;
3. a separate C candidate host materialized from the repository's current native/rclvm.c;
4. current-JS vs native-process differential equivalence for positive and negative cases;
5. deterministic native replay;
6. VM-emitted rcl.semantic-state-root.v1 verification on every successful native case;
7. content roots for implementation sources, materialized VM and candidate host;
8. no silently omitted cases.

Only if every check passes may rcl.domain-organ-native-promotion-report.v0.1 say native-verified. Canonical admission remains false after that.

Local evidence already obtained

Against the uploaded RCL native snapshot, the candidate architecture has executed:

• evidence-tier rejection before invocation;
• Text / Sequence / typed Quantity value membrane round-trips;
• unsupported native value fail-closure;
• literal and dynamic core.echo;
• quantity.make positive and invalid-type controls;
• measurement confidence/type controls;
• knowledge confidence/type controls;
• legacy RBC 1.1 compatibility;
• a nontrivial Quantity → Measurement → Knowledge chain.

The full chain used 51 RBC instructions, allocated/registered seven typed objects, and produced candidate native state that is semantically identical to independently constructed current quantity(), measurement() and knowledgeClaim() objects after native heap metadata removal.

Both canonicalize to semantic root:

736b336eecb96c4fb3a02eaa7d4b9d6e07fd126d65de31d541cf47444bc33509

The uploaded native snapshot predates PR #29 native state-root emission, so this local evidence does not upgrade any operation to native-verified.

Exact-current-source gate

Checked-in tests materialize from the repository's actual current native/rclvm.c and require VM-emitted semantic-root parity plus exact positive/negative semantic identity.

The GitHub hosted workflows currently create jobs but fail before any job step executes (steps: null). Therefore the exact-current-source promotion suite is implemented / execution receipt pending, not passed and not failed semantically.

Explicit non-claims

This PR does not:

• change canonical RBC to 1.3;
• add opcode 45 to canonical src/bytecode.mjs;
• modify canonical native/rclvm.c or native/rclvm.h;
• modify the self-hosted compiler;
• reuse stale branch binaries;
• restore the other 14 historical operations;
• claim Foundation Provider Bridge equivalence;
• claim any organ has actually completed current-source Native Promotion yet;
• change VERSION-CONTRACT.json or component versions.

Required disposition before merge/canonicalization

Run the operation-scoped differentials and full Domain Organ Native Promotion suite on an execution environment that actually starts the jobs. Review the resulting four operation reports independently. Only verified operations may be represented as native-verified, and even then RBC 1.3/opcode45 canonical admission requires a separate PR/governance decision.

Current disposition

CANDIDATE / DRAFT / NATIVE PROMOTION EXECUTION RECEIPT PENDING.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
rcl-rncs-mcp	Ready	Preview	Aug 9, 2026 2:20am

[xingxuling]

Phase 1/2 evidence update

The source-only salvage layer has now been locally exercised against the user-uploaded RCL v0.94 source snapshot. Before treating that run as relevant, the three runtime dependencies were Git-blob checked against current main and matched exactly:

• src/quantity.mjs → edeb3926d2b85e0b9f617cac97fc47d23018c1d1
• src/knowledge.mjs → 35d110c060af045d22976b78971bb235e9aa424e
• src/errors.mjs → 4e35b747680cfbc918ee28522a68b3c25de3c46a

Focused salvage result: 7/7 PASS, 0 fail.

A second module, src/rbc13-domain-call-differential.mjs, now connects the four admitted operations to the existing Independent Differential Absorption framework with six positive/negative cases and a mutation control. It remains unexecuted in the uploaded snapshot because that snapshot predates src/differential-absorption-runner.mjs.

GitHub-hosted PR workflows again failed before executing job steps (job has no step records), matching the existing account/runner infrastructure blocker; this is not recorded as a code-test failure.

Machine-readable boundary/evidence: examples/rbc13-domain-call-salvage-evidence-2026-08-08.json.

Current verdict remains CANDIDATE. No opcode/compiler/native VM/version/authority claim is promoted by this update.