feat(arch): make typed-wasm-verify optional + own the ownership codec in-tree

Group 2 of the estate disentangling: ephapax no longer has a hard
mandatory dep on the typed-wasm repo. After this PR, ephapax builds
+ tests cleanly with `cargo build --no-default-features`, satisfying
the architectural rule that typed-wasm must be removable from
either language with no impact on the language itself.

Design (user-decided 2026-05-26):

  1. Section emission is ALWAYS ON — ownership is ephapax's own
     discipline (linear types are its core feature), not a typed-wasm
     concern. Ephapax now owns its own copy of the section codec.
  2. typed-wasm-verify is an OPTIONAL dep, default-on, behind a
     feature flag of the same name. Powers the post-codegen
     `ephapax compile --verify-ownership` flag.
  3. With the feature OFF, `--verify-ownership` becomes a no-op
     (warns and continues); the emitted wasm still carries the
     `typedwasm.ownership` section so any later off-tree verifier
     can pick it up.

Changes:

  - New `src/ephapax-wasm/src/ownership.rs` (~210 LoC including
    5 unit tests):
      * `OWNERSHIP_SECTION_NAME` constant (= "typedwasm.ownership")
      * `OwnershipKind` enum + `from_byte`/`to_byte`
      * `OwnershipEntry` struct
      * `build_ownership_section_payload` / `parse_ownership_section_payload`
      * `LenientReader` helper
    Byte-for-byte parity with `typed_wasm_verify::section`; any
    future wire-format change must be coordinated.

  - `src/ephapax-wasm/src/lib.rs`: 13 use sites flipped from
    `typed_wasm_verify::*` to `ownership::*` (production + test).
    Module re-exports the public surface so existing callers stay
    unchanged.

  - `src/ephapax-wasm/Cargo.toml`: removed `typed-wasm-verify` dep
    entirely. ephapax-wasm now has zero git deps on sibling repos.

  - `src/ephapax-cli/Cargo.toml`: `typed-wasm-verify` is now
    `{ workspace = true, optional = true }`; new `[features]`
    section with `default = ["typed-wasm-verify"]`.

  - `src/ephapax-cli/src/main.rs`: `report_ownership_verification`
    gated by `#[cfg(feature = "typed-wasm-verify")]`; call site at
    `compile_file` runs the verifier when feature ON, prints a
    stderr warning + continues when OFF.

  - `src/ephapax-cli/tests/cli_verify_ownership.rs`: the 2 positive
    tests (assert verifier output) gated by `#[cfg(feature =
    "typed-wasm-verify")]`. The negative test (assert verifier
    absence without `--verify-ownership`) stays unconditional.

Build matrix verified locally:
  - `cargo build --workspace`                    → clean (default ON)
  - `cargo build -p ephapax-cli --no-default-features` → clean
  - `cargo test  -p ephapax-wasm`                → 84/84 passing
    (includes the 5 new ownership-codec unit tests)
  - `cargo test  -p ephapax-cli`                 → 13/13 passing
  - `cargo test  -p ephapax-cli --no-default-features` → 13/13 passing
    (the 2 verifier tests are cfg-skipped; non-verifier test still
    asserts the absence-of-verifier-output)

Stacks on #137 (the typedwasm.ownership rename). When #137 merges,
this PR will auto-retarget to main.

Follow-up: add a `--no-default-features` CI job to ephapax's
workflow to keep the dep-free build green automatically.

Refs: estate disentangling Group 2. Closes the architectural
violation flagged in `project_estate_disentangle_typedwasm.md`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

Cargo.lock

@@ -26,13 +26,28 @@ ephapax-wasm.workspace = true
 ephapax-interp.workspace = true
 ephapax-repl.workspace = true
 ephapax-package.workspace = true
-typed-wasm-verify.workspace = true
+# `typed-wasm-verify` is optional: it powers `ephapax compile
+# --verify-ownership`, which is a post-codegen L7+L10 verifier. With
+# the feature OFF the CLI builds + runs without any reference to the
+# typed-wasm repo; emitted wasm still carries the `typedwasm.ownership`
+# section (codec lives in ephapax-wasm/src/ownership.rs), but the
+# `--verify-ownership` flag becomes a no-op (warns and continues).
+typed-wasm-verify = { workspace = true, optional = true }
 smol_str.workspace = true
 clap.workspace = true
 colored.workspace = true
 ariadne.workspace = true
 serde_json.workspace = true
 
+[features]
+default = ["typed-wasm-verify"]
+# Enabling this feature pulls in `typed-wasm-verify` (a git dep on
+# hyperpolymath/typed-wasm) and activates the post-codegen verifier
+# behind `ephapax compile --verify-ownership`. Disabling it removes
+# all references to typed-wasm and makes ephapax fully buildable
+# without any sibling-repo network access.
+"typed-wasm-verify" = ["dep:typed-wasm-verify"]
+
 [dev-dependencies]
 wasmtime.workspace = true
 proptest = { workspace = true }

src/ephapax-cli/Cargo.toml

@@ -567,9 +567,23 @@ fn finish_compile(
 
     // Run the typed-wasm L7+L10 verifier on the emitted module if
     // requested. Fails the build with a non-zero exit if any
-    // ownership violation is found.
+    // ownership violation is found. Gated by the `typed-wasm-verify`
+    // feature: when off, --verify-ownership warns and continues.
     if verify_ownership {
-        report_ownership_verification(&wasm_bytes, verbose)?;
+        #[cfg(feature = "typed-wasm-verify")]
+        {
+            report_ownership_verification(&wasm_bytes, verbose)?;
+        }
+        #[cfg(not(feature = "typed-wasm-verify"))]
+        {
+            eprintln!(
+                "{} --verify-ownership requested but this build was \
+                 compiled without the `typed-wasm-verify` feature; \
+                 skipping verification (emitted wasm still carries the \
+                 typedwasm.ownership section).",
+                "warning:".yellow().bold()
+            );
+        }
     }
 
     // Write output
@@ -611,6 +625,11 @@ fn finish_compile(
 /// has no ownership section, which both verifiers treat as fully
 /// unconstrained). Returns `Err` with a user-facing message if any
 /// violation is found — the caller surfaces this as a non-zero exit.
+///
+/// Gated by `feature = "typed-wasm-verify"`. With the feature off, the
+/// call site at `compile_file` skips this function entirely and emits
+/// a stderr warning instead.
+#[cfg(feature = "typed-wasm-verify")]
 fn report_ownership_verification(wasm_bytes: &[u8], verbose: bool) -> Result<(), String> {
     use typed_wasm_verify::{verify_from_module, VerifyError};
 

src/ephapax-cli/src/main.rs

@@ -8,13 +8,21 @@
 // in `typed-wasm-verify`; this test exists to prove the CLI plumbing
 // works — flag parsing → post-compile verification call → exit code
 // → user-facing output.
+//
+// The two positive-assertion tests are gated by the
+// `typed-wasm-verify` feature: with the feature OFF, the CLI prints a
+// warning and skips verification, so the "verification: clean" line
+// the tests look for is absent (by design). The third test —
+// `compile_without_verify_flag_does_not_run_verifier` — works
+// regardless because it asserts an *absence* of verifier output.
 
 use std::process::Command;
 
 fn ephapax_bin() -> String {
     env!("CARGO_BIN_EXE_ephapax").to_string()
 }
 
+#[cfg(feature = "typed-wasm-verify")]
 #[test]
 fn verify_ownership_clean_module() {
     let src = tempfile::NamedTempFile::with_suffix(".eph").expect("tempfile");
@@ -48,6 +56,7 @@ fn verify_ownership_clean_module() {
     );
 }
 
+#[cfg(feature = "typed-wasm-verify")]
 #[test]
 fn verify_ownership_linear_program() {
     // A program that takes a linear String param and consumes it

src/ephapax-cli/tests/cli_verify_ownership.rs

@@ -17,12 +17,18 @@ categories.workspace = true
 ephapax-syntax = { workspace = true }
 ephapax-ir = { workspace = true }
 smol_str = { workspace = true }
-typed-wasm-verify = { workspace = true }
 wasm-encoder = { workspace = true }
 gimli = { version = "0.31", features = ["write"] }
 object = "0.36"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 
+# NOTE: this crate intentionally does NOT depend on `typed-wasm-verify`.
+# Ephapax owns its own copy of the `typedwasm.ownership` section codec
+# in `src/ownership.rs`. Ownership annotations are ephapax's own
+# discipline (linear types); `typed-wasm-verify` is an optional
+# post-codegen verifier consumed only by `ephapax-cli` behind a
+# feature flag. See `src/ownership.rs` header for the full rationale.
+
 [dev-dependencies]
 wasmparser = "0.221"

src/ephapax-wasm/Cargo.toml

@@ -45,8 +45,13 @@
 //! Mode is set per-module compilation and affects how unused linear values are handled.
 
 mod debug;
+pub mod ownership;
 
 pub use debug::{DebugInfo, VariableMetadata};
+pub use ownership::{
+    build_ownership_section_payload, parse_ownership_section_payload, OwnershipEntry,
+    OwnershipKind, OWNERSHIP_SECTION_NAME,
+};
 
 use ephapax_ir::module_from_sexpr;
 use ephapax_syntax::{
@@ -1277,7 +1282,7 @@ impl Codegen {
     /// missing entries as fully Unrestricted, so the smaller payload
     /// has identical semantics.
     fn emit_ownership_section(&mut self) {
-        let mut entries: Vec<typed_wasm_verify::OwnershipEntry> = self
+        let mut entries: Vec<ownership::OwnershipEntry> = self
             .user_fns
             .values()
             .filter(|info| info.param_linear.iter().any(|&l| l))
@@ -1287,16 +1292,16 @@ impl Codegen {
                     .iter()
                     .map(|&is_linear| {
                         if is_linear {
-                            typed_wasm_verify::OwnershipKind::Linear
+                            ownership::OwnershipKind::Linear
                         } else {
-                            typed_wasm_verify::OwnershipKind::Unrestricted
+                            ownership::OwnershipKind::Unrestricted
                         }
                     })
                     .collect();
-                typed_wasm_verify::OwnershipEntry {
+                ownership::OwnershipEntry {
                     func_idx: info.wasm_fn_idx,
                     param_kinds,
-                    ret_kind: typed_wasm_verify::OwnershipKind::Unrestricted,
+                    ret_kind: ownership::OwnershipKind::Unrestricted,
                 }
             })
             .collect();
@@ -1306,9 +1311,9 @@ impl Codegen {
         // `user_fns` is a HashMap; sort by func_idx for deterministic output.
         entries.sort_by_key(|e| e.func_idx);
 
-        let payload = typed_wasm_verify::build_ownership_section_payload(&entries);
+        let payload = ownership::build_ownership_section_payload(&entries);
         let custom = wasm_encoder::CustomSection {
-            name: typed_wasm_verify::OWNERSHIP_SECTION_NAME.into(),
+            name: ownership::OWNERSHIP_SECTION_NAME.into(),
             data: payload.as_slice().into(),
         };
         self.module.section(&custom);
@@ -4580,7 +4585,7 @@ mod tests {
         for payload in WP::new(0).parse_all(wasm) {
             if let Payload::CustomSection(reader) = payload.expect("wasm parse")
             {
-                if reader.name() == typed_wasm_verify::OWNERSHIP_SECTION_NAME {
+                if reader.name() == ownership::OWNERSHIP_SECTION_NAME {
                     return Some(reader.data().to_vec());
                 }
             }
@@ -4609,15 +4614,15 @@ mod tests {
         assert_wasm_header(&wasm);
 
         let payload = ownership_payload(&wasm).expect("ownership section missing");
-        let entries = typed_wasm_verify::parse_ownership_section_payload(&payload);
+        let entries = ownership::parse_ownership_section_payload(&payload);
         assert_eq!(entries.len(), 1, "expected one ownership entry");
         assert_eq!(
             entries[0].param_kinds,
-            vec![typed_wasm_verify::OwnershipKind::Linear]
+            vec![ownership::OwnershipKind::Linear]
         );
         assert_eq!(
             entries[0].ret_kind,
-            typed_wasm_verify::OwnershipKind::Unrestricted
+            ownership::OwnershipKind::Unrestricted
         );
     }
 
@@ -4683,7 +4688,7 @@ mod tests {
         };
         let wasm = compile_module(&module).expect("compilation failed");
         let payload = ownership_payload(&wasm).expect("ownership section missing");
-        let entries = typed_wasm_verify::parse_ownership_section_payload(&payload);
+        let entries = ownership::parse_ownership_section_payload(&payload);
         assert_eq!(entries.len(), 2);
         assert!(
             entries[0].func_idx < entries[1].func_idx,
@@ -4720,11 +4725,11 @@ mod tests {
         };
         let wasm = compile_module(&module).expect("compilation failed");
         let payload = ownership_payload(&wasm).expect("ownership section missing");
-        let entries = typed_wasm_verify::parse_ownership_section_payload(&payload);
+        let entries = ownership::parse_ownership_section_payload(&payload);
         assert_eq!(entries.len(), 1, "only the Linear fn should be listed");
         assert_eq!(
             entries[0].param_kinds,
-            vec![typed_wasm_verify::OwnershipKind::Linear]
+            vec![ownership::OwnershipKind::Linear]
         );
     }