Skip to content

spike(W-003): capability types + one runtime ownership bit - feasibility prototype for #193 - #1071

Open
zidirahim617-del wants to merge 1 commit into
limitlessprojects:mainfrom
zidirahim617-del:feat/w003-capability-bits
Open

zidirahim617-del wants to merge 1 commit into
limitlessprojects:mainfrom
zidirahim617-del:feat/w003-capability-bits

Conversation

@zidirahim617-del

Copy link
Copy Markdown
Contributor

Ledger ID: W-003 (Slot 3, Family A, 2026-11-01 review window per #365) — Source Proposal: #193 — maintainer verification pending, like the other family spikes (#336, #370, #381).

Bounded, zero-dependency Go prototype of the runtime half of W-003: linear capability types backed by one ownership bit per composite, so every accept-then-race seam fails closed at the boundary instead of racing.

Pre-registered falsifiers — all three stand against the running spike:

# Falsifier Outcome
P1 own-use-after-move runs instead of failing closed NOT falsified (second Move rejects, hyb: use of moved value ... (fail-closed))
P2 share peer crosses after its peer moved NOT falsified — one crossing per peer set, later peers reject (the PR #214 seam as one flag)
P3 boundary check allocates / costs > 50 ns NOT falsified — 0 B/op, 0 allocs/op, 13.03 ± 0.15 ns/op (AMD64, Go 1.27.0, -count=3), including the capability re-mint

Regression mapping (why this is the seam, not a seam): #37/#44 const-write family → T1 (second use of a consumed bit rejects); PR #214..#218 slot-loan/backedge family → T2 (the freeze becomes one shared flag); #110/#111/#123/#126 frame-ownership class → removed by construction (one owner-transition).

A fourth seam declared out of reach before running (honest scope note): View[T] stored-in-field is the type-level half; not enforced in this prototype (L2).

Full falsifier log, benchmark results with baselines, the three "review will press on" answers with measured numbers, and limitations L1–L4: RESULTS.md

@zidirahim617-del

Copy link
Copy Markdown
Contributor Author

CI note: compiler and quick both pass on this spike PR. The failing board check is this repo's own project-board rewrite workflow failing with 403 Resource not accessible by integration when it PATCHes issue #940 with a fork PR's read-only GITHUB_TOKEN — it touches nothing in this spike (the workflow result is independent of the spike's RESULTS.md/work/ contents and the same write-permission class gap appears closed in maintainer-side CI recovery history, cf. the CI-recovery Hall of Fame entry). Flagging it here so the verdict path (reproduction/verification) is not read as a spike defect.

@github-actions github-actions Bot added the bot:land-candidate Shepherd: fresh, gate-clean, verifiable (set from classify()) label Oct 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bot:land-candidate Shepherd: fresh, gate-clean, verifiable (set from classify())

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant