-
ABI + proofs: Idris 2 (dependent types;
%default total). Each component’s ABI lives insrc/<Name>ABI/— tag encodings with round-trip proofs, state-machine GADTs, and the FFI contract. Type-checking is proof checking. -
FFI / engines: Zig 0.15+ in
ffi/zig/, exporting a C ABI. -
Bridge: generated C headers in
generated/abi/. -
Bindings: 20 languages in
bindings/— Ada, C++, C#, Dart, Elixir, Gleam, Go, Haskell, Java, JavaScript, Julia, Kotlin, Lua, OCaml, PHP, Python, ReScript, Ruby, Rust, Swift — thin wrappers over the same C ABI (Elixir/Gleam/ReScript are constants-only scaffolds pending FFI; see ADR 0003).
# Idris2 core + proofs for one component (a clean build = proofs verified):
idris2 --build protocols/proven-<name>/proven-<name>.ipkg
# Zig FFI engine (shared + static libraries):
(cd protocols/proven-<name>/ffi/zig && zig build)
# Or, via the task runner:
just build# One engine's FFI tests:
(cd protocols/proven-<name>/ffi/zig && zig build test)
# Full end-to-end suite (FFI builds + safety aspects):
bash tests/e2e.sh # or: just testproven-servers/
├── src/ # Source code
├── src/abi/ # Idris2 ABI definitions (if applicable)
├── ffi/zig/ # Zig FFI bridge (if applicable)
├── tests/ # Test suite
├── docs/ # Documentation
├── .machine_readable/ # Checkpoint files (STATE, META, ECOSYSTEM)
├── Justfile # Task runner recipes
├── guix.scm # Guix environment
├── flake.nix # Nix environment (fallback)
└── 0-AI-MANIFEST.a2ml # AI agent entry pointjust build # Build the project
just test # Run tests
just doctor # Self-diagnostic
just lint # Lint and format
just panic-scan # Security scan via panic-attacker
just tour # Guided tour of the codebasejust lint # Format and lint
just test # All tests pass
just panic-scan # No new security issuesRead .machine_readable/MUST.contractile before making changes.
Key invariants that must never be violated:
-
The ABI is defined in Idris 2; FFIs/APIs are implemented in Zig (the RSR standard — see
ABI-FFI-README.md). -
No proof-escape hatches in Idris code (
believe_me,assert_total,assert_smaller,idris_crash,postulate);%default totalin every module. -
No
@panicorunreachablein Zig FFI production code; every exported function is NULL-/invalid-handle-safe. -
ABI tag values must match exactly between Idris (
*ABI.Types) and Zig (@intFromEnum); the FFI tests enforce this. -
Every component’s ABI modules are listed in its
.ipkg, so the proofs are actually compiled (not orphaned).
If using an AI assistant, load the warmup context first:
just llm-context # Outputs role-appropriate contextOr read 0-AI-MANIFEST.a2ml and .claude/CLAUDE.md directly.
-
Architecture: EXPLAINME.adoc
-
Report issue:
just help-me