fix(chapel-binding): real-Chapel-2.x typecheck + WIRED-subset zig build fix

Wave 1 follow-up to PR #135 (binding-tier-1 Chapel pilot).  Three
distinct issues surfaced in CI on #135's first run, each of which was
hiding behind the binding's never-having-been-compiled state.

1. CHAPEL TYPECHECK: T? syntax is class-only
============================================

The pre-existing binding used Chapel's `T?` postfix on value-type
returns: `proc safeAdd(a, b): int(64)?`, `bool?`, `string?`.
That syntax is class-only in Chapel 2.x — every Safe*.chpl module
fails to typecheck.  All 11 modules were affected; this is the deep
"binding looked well-written but had never been compiled" finding.

Replacement: `Maybe(T)` — a binding-provided generic record with
`present: bool` and `value: T`, with constructors `some(v)` and
`absent(T)`.  Naming note: `none` and `nothing` are both Chapel
reserved words, so the absent constructor is `absent`.

All 11 Safe*.chpl wrappers + smoke + 3 tests rewritten.
`Proven.chpl` adds `public import SafePath / SafeHeader / LibProven`
so callers can write `SafePath.hasTraversal(...)` as a qualified
reference.

`enum ProvenStatus : int(32) { ... }` typed-enum syntax was also
removed in Chapel 2.x.  Dropped the type spec.

`extractString` / `cStringToChapel` switched to `try!` for
`string.createCopyingBuffer`, which is a throwing function in
Chapel 2.x — the FFI guarantees the buffer shape so the unconditional
unwrap is sound.

2. CI BUILD: ffi/zig/build.zig depends on a missing repo
========================================================

`hyperpolymath/idris2-zig-ffi` returns 404 to authenticated `gh`.
The same break blocks `zig-ffi.yml` on main; resolving the
upstream dep is out of scope for the Chapel pilot.

All exports in `ffi/zig/src/main.zig` are pure-Zig (only `@import
("std")` + `@import("builtin")`); none actually consume the
`idris2_zig_ffi` module.  Switched `chapel-build` to compile
`main.zig` directly via `zig build-lib -dynamic -lc`, producing
a libproven.so with the WIRED 5 symbols.

`build.zig.zon` declares `minimum_zig_version = "0.15.2"`; bumped
the CI's pinned Zig from 0.13.0 to 0.15.2 to match.

3. proven.h missing `proven_version` / `proven_build_info`
==========================================================

These two accessors are exported by `ffi/zig/src/main.zig` and
called by the Chapel `libraryVersion()` / `libraryBuildInfo()`
helpers.  `chpl` performs extern-decl resolution against included
C headers and fails the build when an `extern` references a symbol
not declared in any `-I`-supplied header.

Added two declarations to `bindings/c/include/proven.h`.  These do
NOT introduce new Zig exports — they declare functions that
`main.zig` has always exported.

Verification
============

Locally (chpl 2.8.0 + zig 0.15.2 against a freshly-built libproven.so):

  $ just check    # symbol-audit PASS 5/0
  $ just build    # smoke target builds
  $ just test     # smoke + 4 tests all GREEN

  hello_smoke: OK (libproven 0.1.0)
  TestFfiContract: OK
  TestLibraryInfo: OK (version=0.1.0)
  TestSafeHeader: OK
  TestSafePath: OK

All 11 src/*.chpl typecheck clean with `chpl --no-codegen`.

Detachability is preserved: every change here is inside the
detachable file set (`bindings/chapel/**`, `bindings/c/include/proven.h`,
the workflow).  No new repo-root reach.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/chapel-ci.yml

@@ -58,7 +58,9 @@ env:
   CHAPEL_DEB_URL: 'https://github.com/chapel-lang/chapel/releases/download/2.3.0/chapel-2.3.0-1.ubuntu22.amd64.deb'
   CHAPEL_DEB_SHA256: 'b7c1a48cbf26cfc7ad9af22a84ea4becb1a5e2fd485ec4a1f5f8a69e8a7cd58c'
   # Pinned Zig version (kept in sync with .github/workflows/zig-ffi.yml).
-  ZIG_VERSION: '0.13.0'
+  # Pinned Zig version.  Matches ffi/zig/build.zig.zon's
+  # `minimum_zig_version = "0.15.2"`.
+  ZIG_VERSION: '0.15.2'
 
 jobs:
   # ==========================================================================
@@ -124,20 +126,39 @@ jobs:
         with:
           path: proven
 
-      - name: Checkout idris2-zig-ffi dependency
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-        with:
-          repository: hyperpolymath/idris2-zig-ffi
-          path: idris2-zig-ffi
-
       - name: Setup Zig ${{ env.ZIG_VERSION }}
         uses: mlugg/setup-zig@e7d1537c378b83b8049f65dda471d87a2f7b2df2 # v1
         with:
           version: ${{ env.ZIG_VERSION }}
 
-      - name: Build libproven.so via Zig
+      - name: Build libproven.so (WIRED-subset fixture)
         working-directory: proven/ffi/zig
-        run: zig build -Dtarget=x86_64-linux-gnu
+        # NOTE: ffi/zig/build.zig depends on `idris2_zig_ffi` (relative
+        # path to a sibling estate repo).  That dep is not resolvable
+        # from a fresh clone in CI (the same issue blocks zig-ffi.yml on
+        # main), and resolving it is out of scope for the Chapel pilot.
+        # All exports in src/main.zig are pure-Zig — none consume
+        # idris2_zig_ffi.  We compile main.zig directly with
+        # `zig build-lib -dynamic -lc`, producing a libproven.so with
+        # the WIRED 5 symbols (proven_path_has_traversal,
+        # proven_header_has_crlf, proven_free_string, proven_version,
+        # proven_build_info).  When proven#88 lands the real
+        # Idris-backed exports, this step swaps to
+        # `zig build -Dtarget=...`.
+        run: |
+          set -euo pipefail
+          mkdir -p zig-out/lib
+          zig build-lib -dynamic -O ReleaseSafe \
+              -fPIC \
+              --name proven \
+              -femit-bin=zig-out/lib/libproven.so \
+              src/main.zig -lc
+          ls -la zig-out/lib/
+          nm -D --defined-only zig-out/lib/libproven.so \
+              | awk '$2 ~ /^[TWV]$/ { print $3 }' \
+              | grep -E '^(proven_path_has_traversal|proven_header_has_crlf|proven_free_string|proven_version|proven_build_info)$' \
+              | sort -u | tee /tmp/wired-exports.txt
+          test "$(wc -l < /tmp/wired-exports.txt)" -eq 5
 
       - name: Install Chapel ${{ env.CHAPEL_VERSION }} (SHA-pinned .deb)
         run: |
@@ -148,14 +169,13 @@ jobs:
           sudo apt-get install -y /tmp/chapel.deb
           chpl --version
 
-      - name: Chapel module typecheck (--library on every module)
+      - name: Chapel module typecheck (--no-codegen, every module)
         working-directory: proven/bindings/chapel
         run: |
           set -euo pipefail
           for m in src/*.chpl; do
               echo "[chapel-build] typecheck $m"
-              chpl --library --dynamic --print-callstack-on-error \
-                   --no-codegen \
+              chpl --no-codegen --print-callstack-on-error \
                    -M src/ \
                    -I "$GITHUB_WORKSPACE/proven/bindings/c/include" \
                    "$m"

bindings/c/include/proven.h

@@ -169,6 +169,20 @@ uint32_t proven_version_patch(void);
 /** @brief Get total module count. */
 uint32_t proven_module_count(void);
 
+/**
+ * @brief Get the library version string (NUL-terminated, statically allocated).
+ *
+ * The returned pointer is owned by the library; do NOT free it.
+ */
+const char* proven_version(void);
+
+/**
+ * @brief Get build information (compiler, target, etc.; NUL-terminated, static).
+ *
+ * The returned pointer is owned by the library; do NOT free it.
+ */
+const char* proven_build_info(void);
+
 /* ============================================================================
  * SafeMath - Arithmetic that cannot crash (9 functions)
  * ============================================================================ */

bindings/chapel/README.adoc

@@ -74,8 +74,10 @@ just test
 use Proven;
 
 // WIRED: links + runs against libproven 0.9.0.
-var trav = SafePath.hasTraversal("../../etc/passwd"); // some(true)
-var crlf = SafeHeader.hasCrlf("v\r\nX-Inj: 1");       // some(true)
+// WIRED: links + runs against libproven 0.9.0.
+var trav = SafePath.hasTraversal("../../etc/passwd"); // Maybe(bool): some(true)
+var crlf = SafeHeader.hasCrlf("v\r\nX-Inj: 1");       // Maybe(bool): some(true)
+if trav.present && trav.value then writeln("blocked");
 
 // Identify the linked libproven (debug-friendly).
 writeln("libproven version: ", libraryVersion());
@@ -88,21 +90,35 @@ writeln("libproven version: ", libraryVersion());
 
 == Error Handling
 
-All fallible operations return Chapel optional types (`T?`). Use pattern
-matching to handle errors:
+All fallible operations return `Maybe(T)` — a binding-provided record
+with a `present` flag and a `value`.  Chapel 2.x's built-in `T?`
+postfix syntax is class-only and does NOT compile for value types
+(`bool?`, `int?`, `string?` all error); `Maybe(T)` is the
+binding-tier replacement.
 
 [source,chapel]
 ----
 var result = SafePath.hasTraversal(userInput);
-if result == none {
+if !result.present {
   writeln("FFI error reading input");
-} else if result! {
+} else if result.value {
   writeln("Path traversal detected — refusing");
 } else {
   writeln("Path is safe");
 }
 ----
 
+The constructors are `some(value)` and `absent(T)`:
+
+[source,chapel]
+----
+return some(true);            // Maybe(bool) with present == true
+return absent(int(64));       // Maybe(int(64)) with present == false
+----
+
+(`absent` rather than `none`/`nothing` because both of those are
+reserved words in Chapel.)
+
 == Coverage matrix (WIRED vs GATED)
 
 WIRED — present in `libproven 0.9.0`, verified by `chapel-symbol-audit`,

bindings/chapel/smoke/hello_smoke.chpl

@@ -3,11 +3,8 @@
 //
 // hello_smoke.chpl - End-to-end "does the binding link and run" smoke test.
 //
-// Builds:
-//   chpl -o hello_smoke smoke/hello_smoke.chpl -M src/ -lproven
-//
 // Runs in well under 2s and is kept green by chapel-ci.yml even if larger
-// jobs go red.  This is the "the binding actually works" gate.
+// jobs go red.
 //
 // Calls the WIRED subset only.  Lifecycle (provenInit/Deinit) is GATED on
 // proven#88 because the Zig export ABI does not yet match the proven.h
@@ -16,34 +13,28 @@
 use Proven;
 
 proc main(): int {
-  // SafePath.hasTraversal — happy path (no traversal) and detection path.
-  const safePath = "/var/www/html/index.html";
-  const evilPath = "../../etc/passwd";
-
-  const okSafe = SafePath.hasTraversal(safePath);
-  const okEvil = SafePath.hasTraversal(evilPath);
+  // SafePath.hasTraversal — happy + detection paths.
+  const okSafe = SafePath.hasTraversal("/var/www/html/index.html");
+  const okEvil = SafePath.hasTraversal("../../etc/passwd");
 
-  if okSafe == none || okSafe! != false {
-    writeln("FAIL: SafePath.hasTraversal('", safePath, "') did not return some(false)");
+  if !okSafe.present || okSafe.value != false {
+    writeln("FAIL: SafePath.hasTraversal('/var/www/html/index.html') did not return some(false)");
     return 1;
   }
-  if okEvil == none || okEvil! != true {
-    writeln("FAIL: SafePath.hasTraversal('", evilPath, "') did not return some(true)");
+  if !okEvil.present || okEvil.value != true {
+    writeln("FAIL: SafePath.hasTraversal('../../etc/passwd') did not return some(true)");
     return 1;
   }
 
-  // SafeHeader.hasCrlf — happy path (no CRLF) and detection path.
-  const safeHeader = "application/json";
-  const evilHeader = "value\r\nX-Injected: hi";
-
-  const headerOkSafe = SafeHeader.hasCrlf(safeHeader);
-  const headerOkEvil = SafeHeader.hasCrlf(evilHeader);
+  // SafeHeader.hasCrlf — happy + detection paths.
+  const headerOkSafe = SafeHeader.hasCrlf("application/json");
+  const headerOkEvil = SafeHeader.hasCrlf("value\r\nX-Injected: hi");
 
-  if headerOkSafe == none || headerOkSafe! != false {
-    writeln("FAIL: SafeHeader.hasCrlf('", safeHeader, "') did not return some(false)");
+  if !headerOkSafe.present || headerOkSafe.value != false {
+    writeln("FAIL: SafeHeader.hasCrlf('application/json') did not return some(false)");
     return 1;
   }
-  if headerOkEvil == none || headerOkEvil! != true {
+  if !headerOkEvil.present || headerOkEvil.value != true {
     writeln("FAIL: SafeHeader.hasCrlf(<CRLF>) did not return some(true)");
     return 1;
   }

bindings/chapel/src/LibProven.chpl

@@ -35,8 +35,14 @@ module LibProven {
   // Status codes (used by both WIRED and GATED results)
   // ========================================================================
 
-  /** Status codes returned by Proven operations. */
-  enum ProvenStatus : int(32) {
+  /** Status codes returned by Proven operations.
+   *
+   * Chapel 2.x removed the `enum X : int(32) { ... }` type-spec syntax;
+   * the C ABI's int32 status field is the source of truth, and this
+   * enum is for human-readable documentation.  Use `.toInt(32)` (or
+   * compare via the `isOk` helper) when interoperating with FFI.
+   */
+  enum ProvenStatus {
     OK                   =   0,
     ErrNullPointer       =  -1,
     ErrInvalidArgument   =  -2,
@@ -266,6 +272,37 @@ module LibProven {
       ptr: c_ptrConst(uint(8)), len: c_size_t
   ): FloatResult;
 
+  // ========================================================================
+  // Maybe(T) — Chapel-2.x-compatible optional-type pattern.
+  //
+  // Chapel's `T?` postfix is class-only; value-type wrappers
+  // (`bool?` / `int(64)?` / `string?`) do NOT compile.  Maybe(T) is a
+  // generic record with a `present` flag and a `value`.  `some(v)` and
+  // `none(T)` are the constructors; call sites pattern-match via
+  // `if r.present then r.value else fallback`.
+  // ========================================================================
+
+  /** Optional value-type carrier — see module-level note. */
+  record Maybe {
+    type T;
+    var present : bool;
+    var value   : T;
+  }
+
+  /** Wrap a value as a present Maybe(T). */
+  inline proc some(in v): Maybe(v.type) {
+    return new Maybe(v.type, true, v);
+  }
+
+  /** Construct an absent Maybe(T).  Pass the type explicitly:
+   * `return absent(bool)` / `absent(int(64))` / `absent(string)`.
+   *
+   * (Named `absent` because Chapel reserves `none` and `nothing`.) */
+  inline proc absent(type T): Maybe(T) {
+    var dflt : T;
+    return new Maybe(T, false, dflt);
+  }
+
   // ========================================================================
   // Helper: convert Chapel string to C pointer + length.
   // ========================================================================
@@ -280,18 +317,27 @@ module LibProven {
     return status == 0;
   }
 
-  /** Extract a Chapel string from a StringResult and free the C memory. */
+  /** Extract a Chapel string from a StringResult and free the C memory.
+   *
+   * ``string.createCopyingBuffer`` is throwing; we use ``try!`` because
+   * the C ABI guarantees a valid UTF-8 buffer of declared length when
+   * status is OK.  An empty status / nil pointer short-circuits to "". */
   proc extractString(ref r: StringResult): string {
     if !isOk(r.status) || r.value == nil then return "";
-    var s = string.createCopyingBuffer(r.value: c_ptrConst(c_char), r.length: int);
+    var s = try! string.createCopyingBuffer(r.value: c_ptrConst(c_char),
+                                            r.length: int);
     provenFreeString(r.value);
     return s;
   }
 
-  /** Read a NUL-terminated C string returned by libproven (no free required). */
+  /** Read a NUL-terminated C string returned by libproven (no free required).
+   *
+   * Uses ``try!`` for the same reason as ``extractString``: libproven
+   * guarantees NUL-termination on the string accessors that call this
+   * (proven_version, proven_build_info). */
   proc cStringToChapel(p: c_ptrConst(c_char)): string {
     if p == nil then return "";
-    return string.createCopyingBuffer(p);
+    return try! string.createCopyingBuffer(p);
   }
 
   /** Library version string from the loaded libproven. */

bindings/chapel/src/Proven.chpl

@@ -31,10 +31,15 @@ module Proven {
 
   // Core FFI declarations + helpers (extern types, WIRED externs,
   // GATED extern decls kept under a GATED banner inside LibProven).
+  // `use` brings procs into scope unqualified; `import` makes the
+  // module name itself visible as a qualifier.
   public use LibProven;
+  public import LibProven;
 
-  // WIRED safety modules (smoke + chapel-tests target these):
+  // WIRED safety modules (smoke + chapel-tests target these).
   public use SafePath;
+  public import SafePath;
   public use SafeHeader;
+  public import SafeHeader;
 
 }

bindings/chapel/src/SafeCrypto.chpl

@@ -3,56 +3,43 @@
 //
 // SafeCrypto - Cryptographic primitives via libproven FFI.
 //
-// All computation is performed in the Idris 2 core via the Zig FFI bridge.
-// This module is a thin wrapper; it does NOT reimplement any logic.
+// Status: GATED on proven#88 (proven_crypto_* + proven_hex_encode).
 
 module SafeCrypto {
 
   public use LibProven;
+  use CTypes;
 
-  /**
-   * Constant-time byte comparison (timing-attack safe).
-   *
-   * :arg a: First byte sequence (string).
-   * :arg b: Second byte sequence (string).
-   * :returns: ``none`` on error, true if equal, false otherwise.
-   */
-  proc constantTimeEq(a: string, b: string): bool? {
+  /** Constant-time byte comparison (timing-attack safe). */
+  proc constantTimeEq(a: string, b: string): Maybe(bool) {
     var (ptrA, lenA) = toCBytes(a);
     var (ptrB, lenB) = toCBytes(b);
     var r = provenCryptoConstantTimeEq(ptrA, lenA, ptrB, lenB);
-    if isOk(r.status) then return r.value;
-    return none;
+    if isOk(r.status) then return some(r.value);
+    return absent(bool);
   }
 
   /**
    * Fill a buffer with cryptographically secure random bytes.
    *
-   * :arg n: Number of bytes to generate.
-   * :returns: ``none`` on error, otherwise an array of random bytes.
+   * Returns ``some(true)`` on success and ``absent(bool)`` on failure;
+   * the caller-provided buffer is filled in-place via the FFI.
+   * Array-typed Maybe return is sidestepped because the result type
+   * would carry a domain.
    */
-  proc randomBytes(n: int): [0..#n] uint(8)? {
-    var buf : [0..#n] uint(8);
-    var status = provenCryptoRandomBytes(c_ptrTo(buf[0]), n: c_size_t);
-    if isOk(status) then return buf;
-    return none;
+  proc randomBytes(ref buf: [] uint(8)): Maybe(bool) {
+    var status = provenCryptoRandomBytes(c_ptrTo(buf[buf.domain.low]),
+                                          buf.size: c_size_t);
+    if isOk(status) then return some(true);
+    return absent(bool);
   }
 
-  /**
-   * Encode bytes to hexadecimal string.
-   *
-   * :arg data: Input bytes (string).
-   * :arg uppercase: Use uppercase hex digits (default false).
-   * :returns: ``none`` on error, otherwise the hex string.
-   */
-  proc hexEncode(data: string, uppercase: bool = false): string? {
+  /** Encode bytes to hexadecimal string. */
+  proc hexEncode(data: string, uppercase: bool = false): Maybe(string) {
     var (ptr, len) = toCBytes(data);
     var r = provenHexEncode(ptr, len, uppercase);
-    if isOk(r.status) {
-      var result = extractString(r);
-      return result;
-    }
-    return none;
+    if isOk(r.status) then return some(extractString(r));
+    return absent(string);
   }
 
 }