v0.14.0 Boundary Inventory

Status: complete and confirmed by the adversarial second review (2026-08-23).

This inventory records the production contracts reviewed before v0.14.0 release preparation. A dependency is justified only by the named contract. Test-only composition is listed separately because it must not silently become a production dependency.

Vertical Compiler Pipeline

Owner	Responsibility	Input contracts	Output contracts	Invariants and forbidden knowledge	Production consumers
`nocter-source`	Normalize source bytes and own byte/line/UTF-16 coordinates	Names and bytes	`SourceMap`, `SourceFile`, `Span`, `TextRange`, coordinate conversions	A range belongs to one source and is boundary-valid; no syntax or semantics	syntax, package, discovery, diagnostics, projection, tooling
`nocter-syntax`	Preserve every token while recognizing one parse goal	`SourceFile`	`SyntaxTree`, tokens, nodes, lexical and parse diagnostics	Node/token identity belongs to exactly one tree; no filesystem, package, or semantic identity	package, discovery, compile input, lowering, checking, source tooling, analysis
`nocter-compile-input`	Freeze discovery-selected topology and syntax borrows	source, syntax, model identities, declaration role vocabulary	`CompileUnitInput` and exact module/use/toolchain inputs	No filesystem probing or semantic decisions; consumers must not reopen paths	declaration lowering, checking, discovery, session
`nocter-declaration-lowering`	Convert syntax declarations and imports into syntax-independent semantic declarations	`CompileUnitInput`, target selection	`DeclarationProgram`, `SourceIndex`, typed lowering failures	Creates each semantic identity once; no body semantics or filesystem lookup	checking, session
`nocter-declarations`	Own immutable declaration graph and declaration-level contracts	model identities and structural types	`DeclarationProgram`, `DeclarationGraph`, declaration algebras	No source, syntax, rendered spelling reconstruction, or body decisions	lowering, checking, target program, analysis
`nocter-checking`	Resolve names and build typed bodies, ownership, provenance, conformance, and dispatch facts	compile input, declaration graph, source projection for diagnostics	`CheckedProgram`, recovery snapshots, checked failures	Only phase after lowering allowed to inspect body syntax; later phases may not repeat checking	session, target program, analysis, MIR
`nocter-target-program`	Grant implemented target capability, validate the standard primitive contract, and close one monomorphized executable	checked semantics, target/toolchain capability, semantic primitive bindings	`TargetProgram`, `ExecutableProgram`, executable roots and specialized representations	No source/syntax dependency; every executable dependency is selected before MIR	session, MIR
`nocter-mir`	Lower executable semantics into validated typed CFG and cleanup operations	`ExecutableProgram` and deliberate checked/declaration contracts needed by validation	`MirProgram`, MIR functions and roots	No source, unresolved dispatch, presentation spelling, ABI layout, or machine state	session, machine
`nocter-machine`	Select target-independent layout, ABI transport, linkage, destruction, and machine operations	Validated MIR plus a closed runtime/type-representation contract	`MachineProgram`	Must not inspect target-program, checked program, source graph, symbols, or declaration construction state	session, ARM64
`nocter-arm64`	Select and encode physical ARM64 instructions	`MachineProgram`	`Arm64Program`	No MIR, semantic, source, package, or executable-program dependency	session, Mach-O
`nocter-macho`	Serialize a complete ARM64 Mach-O image	`Arm64Program`, deterministic hash	`MachOImage`	Owns file layout, commands, offsets, signature, and bytes; no compiler phase reconstruction	session, command

Source, Diagnostic, and Tooling Contracts

Owner	Responsibility	Input contracts	Output contracts	Invariants and forbidden knowledge	Production consumers
`nocter-source-index`	Pair semantic identities with exact syntax/source origins	model identities, source, syntax	`SourceIndex`, `SemanticEntity`, documentation and occurrence bindings	Sole semantic/source pairing authority; semantic programs never depend on it	lowering, checking output, diagnostics, session, analysis, command
`nocter-diagnostics`	Carry and render phase-selected source diagnostics	source and source-index origins, syntax failures, JSON writer	`SourceDiagnostic`, human/JSON projections	Does not decide semantic rules; a phase owns the diagnostic meaning	CLI, command, discovery, lowering, checking, analysis, source tooling
`nocter-source-tooling`	Inspect and format one normalized source without compilation	source, syntax, diagnostics	formatter and token projections	No package discovery, semantic resolution, or target selection	command
`nocter-analysis`	Retain one immutable generation and answer protocol-independent semantic queries	discovery snapshot/failure, compiler session output/recovery, source projection	`AnalysisSnapshot`, semantic presentations, edits, locations, highlights, completions	Never substitutes stale success; no URI/JSON-RPC or filesystem scope selection	language server
`nocter-lsp`	Decode, validate, and encode JSON-RPC/LSP protocol values	bounded JSON	validated request/notification values and response encoders	No filesystem or compiler semantics	CLI, language server
`nocter-language-server`	Map protocol documents to canonical paths, select analysis scope, and project compiler queries to LSP	LSP values, filesystem source views, package/discovery/session configuration, analysis contracts	accepted workspace generations and LSP responses	URI/path state and protocol coordinates only; semantic answers remain analysis-owned	CLI

Package, Filesystem, and Process Contracts

Owner	Responsibility	Input contracts	Output contracts	Invariants and forbidden knowledge	Production consumers
`nocter-filesystem`	Select immutable source bytes ahead of disk for one generation	canonical paths, byte snapshots, optional editor metadata	read-only source view	No package mutation, fetching, locking, syntax, or semantics	package, discovery, analysis, language server
`nocter-package`	Decode `nocter.nct` and resolve an exact read-only package graph	source view, syntax, package identities, deterministic hash	package declaration, exact graph, lock update proposal, typed requirements	Sole directive decoder; no network or persistent mutation	installation, discovery, package state, acquisition, command, language server
`nocter-package-acquisition`	Acquire exact remote content into caller-owned staging paths	package-state authority requests and exact source/lock contracts	staged Git/archive package or typed transport/policy failure	No graph validation, publication, or lock commit	CLI through package-state authority
`nocter-package-state`	Coordinate generated locks, staging, validation, exact-store publication, and manifest commit	read-only package resolver and injected acquisition authority	resolved selection with semantically committed root locks	Mutation stays transaction-owned; acquisition cannot publish directly	command
`nocter-discovery`	Probe selected package roots and freeze the exact source/module/use graph	resolved package graph, source view, syntax, target selection, toolchain locators	`DiscoveredUnit`, reached-source failure	Sole module/path probing authority; later phases never reopen imports	session, command, analysis, language server
`nocter-installation`	Select and validate one Nocter home and bundled toolchain installation	process-supplied path request, installation manifest, package identity	`CompilerInstallation`, `StandardPackage`	No process-global reads, argument parsing, user graph resolution, or compilation	CLI
`nocter-session`	Compose one closed compiler or native-output run	discovered unit and explicit executable/test selection	compiled target/executable/native image with independent source projection	No repeated lower-phase decisions; no filesystem persistence or process launch	command, analysis, language server
`nocter-command`	Parse command grammar and orchestrate source initialization, read-only graph inspection, package state, compilation, artifacts, and child processes	package/session/source-tooling contracts and complete Mach-O images	command result/presentation values and bounded filesystem/process effects	Does not assemble compiler stages or reopen target/source identity; graph inspection has no mutation authority	CLI
`nocter-cli`	Read process facts once and adapt public process I/O	installation, command, language-server and diagnostic contracts	process exit status/stdout/stderr behavior	No argument grammar, package interpretation, semantic rule, or backend decision	executable entry point

Shared and Supporting Contracts

Owner	Responsibility	Input contracts	Output contracts	Invariants and forbidden knowledge	Production consumers
`nocter-model`	Own dependency-free semantic identity domains and structural type interning	primitive Rust values	IDs, arenas, symbols, `TypeStore`, target/package identities	No source, syntax, filesystem, or phase implementation	semantic and backend crates
`nocter-runtime-contract`	Own source-independent identities and representations shared across the target, MIR, and machine boundary	model identities and structural types	primitive-role registry, runtime type representations, runtime ABI identity	No source paths, syntax tokens, declaration spellings, target-program storage, or machine policy	compile input, lowering, discovery, session, target program, MIR, machine, ARM64
`nocter-target-selection`	Decide syntax-item activity for one compilation target	source, syntax, recognized target	immutable `TargetSelection`	No package resolution or semantic lowering	discovery, declaration lowering
`nocter-json`	Parse and render bounded deterministic JSON	UTF-8 text/value inputs	JSON value and writer contracts	Bounded nesting; no protocol or diagnostic semantics	LSP, diagnostics, installation, language server
`nocter-hash`	Provide dependency-free deterministic hashing	bytes	stable digest	No package or image policy	package, acquisition, Mach-O

Test-only Responsibilities

Owner	Responsibility	Allowed inputs	Required evidence	Forbidden substitution
`nocter-test-support`	Build compact synthetic compile units for lower-boundary tests	public compile-input/lowering/declaration contracts	Individual phase invariants	It cannot replace production discovery/session/example conformance
`nocter-conformance`	Exercise cross-crate compiler and native behavior	public production facades and explicit fixtures	observable diagnostics, native output, determinism, and boundary rejection	It cannot assert only internal arena shapes
`development/std`	Exercise the language through ordinary authored standard APIs	public language constructs plus explicitly selected primitives	build/run tests and standard-role contract validation	Compiler built-ins cannot replace source-expressible APIs
`examples`	Demonstrate released user workflows	public CLI and language surface	complete build/run qualification	Invalid diagnostic fixtures and repository-only setup stay outside examples

Dependency Conclusions

The first pass identified the following unjustified production edges:

nocter-checking -> nocter-declaration-lowering for compile-input types re-exported by lowering;
nocter-target-program -> nocter-compile-input and nocter-target-program -> nocter-source-index for syntax-token-to-semantic primitive binding;
nocter-machine -> nocter-target-program for ABI identity, primitive role, executable type representation, and one test-name reach-through;
the semantic misuse inside nocter-filesystem whereby a compiler byte override must pretend to be a versioned open editor document.

All four unjustified dependency edges have been removed. nocter-machine now receives the closed MIR program and canonical runtime contracts only; nocter-target-program remains a dev-dependency there solely for integration fixtures. MIR obtains checked semantic facts through explicit executable queries and consumes the executable into a closed runtime environment; executable, target, and checked storage cannot be navigated by backend production code.

The remaining direct edges name deliberate input/output contracts. Some contracts are broad, but a broad contract is not itself a finding unless a consumer relies on a provider's storage nesting or reconstructs an omitted decision.