docs: converge post-migration product contracts

Author: olwang

.github/workflows/release.yml

@@ -42,7 +42,7 @@ jobs:
             exit 1
           }
           EXPECTED="${GITHUB_REF_NAME#v}"
-          for PACKAGE in rsscript-cli reir; do
+          for PACKAGE in rsscript-cli; do
             ACTUAL="$(cargo metadata --locked --no-deps --format-version 1 | jq -r ".packages[] | select(.name == \"$PACKAGE\") | .version // empty")"
             [ -n "$ACTUAL" ] || {
               echo "::error::release package $PACKAGE does not exist"
@@ -60,14 +60,6 @@ jobs:
           cargo clippy --locked --workspace --all-targets -- -D warnings
           cargo test --locked --workspace --all-targets
 
-      - name: Validate native JIT
-        run: cargo nextest run --locked -p rsscript-sdk --features native-jit --no-fail-fast
-
-      - name: Validate generated backend parity
-        run: |
-          RSSCRIPT_FULL_BACKEND_PARITY=1 cargo test --locked -p rsscript-sdk --test runtime -- --test-threads=1
-          RSSCRIPT_FULL_BACKEND_PARITY=1 cargo test --locked -p rsscript-sdk --test differential -- --test-threads=1
-
   release-build:
     needs: [release-validation]
     name: Build ${{ matrix.target }}
@@ -104,10 +96,8 @@ jobs:
           SUFFIX: ${{ matrix.suffix }}
         run: |
           cargo build --locked --frozen --release --target "$TARGET" --bin rss -p rsscript-cli --features host-tools
-          cargo build --locked --frozen --release --target "$TARGET" --bin reir -p reir
           mkdir -p dist
           cp "target/$TARGET/release/rss$SUFFIX" "dist/rss-$TARGET$SUFFIX"
-          cp "target/$TARGET/release/reir$SUFFIX" "dist/reir-$TARGET$SUFFIX"
           PYTHON="$(command -v python3 || command -v python)" || {
             echo "::error::Python 3 is required to create portable checksums"
             exit 1
@@ -120,7 +110,6 @@ jobs:
             rustc -Vv
           } > "dist/BUILD-INFO-$TARGET.txt"
           "dist/rss-$TARGET$SUFFIX" --help >/dev/null
-          "dist/reir-$TARGET$SUFFIX" --help >/dev/null
           "$PYTHON" - "$TARGET" "$SUFFIX" <<'PY'
           import hashlib
           import pathlib
@@ -130,7 +119,6 @@ jobs:
           directory = pathlib.Path("dist")
           names = [
               f"rss-{target}{suffix}",
-              f"reir-{target}{suffix}",
               f"BUILD-INFO-{target}.txt",
           ]
           lines = []
@@ -173,14 +161,12 @@ jobs:
             grep -Fx "commit=$GITHUB_SHA" "$INFO"
           done
           test "$(find . -maxdepth 1 -type f -name 'rss-*' | wc -l)" -eq 3
-          test "$(find . -maxdepth 1 -type f -name 'reir-*' | wc -l)" -eq 3
 
       - name: Attest build provenance
         uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-path: |
             dist/rss-*
-            dist/reir-*
             dist/BUILD-INFO-*.txt
             dist/SHA256SUMS-*
 

Cargo.lock

@@ -72,9 +72,7 @@ rsscript-build-support = { path = "../rsscript-build-support" }
 [dev-dependencies]
 base64 = "0.22"
 jsonschema = { version = "0.49", default-features = false }
-reir = { path = "../../experiments/reir" }
 rsscript-abi-model = { path = "../rsscript-abi-model" }
-rsscript-review-reir = { path = "../../experiments/rsscript-review-reir" }
 rsscript-mir = { path = "../rsscript-mir", features = ["conformance"] }
 sha1 = "0.10"
 proptest = "1"

crates/rsscript-sdk/Cargo.toml

@@ -420,6 +420,29 @@ fn root_workspace_excludes_experimental_packages() {
     }
 }
 
+#[test]
+fn sdk_development_closure_does_not_compile_experimental_integrations() {
+    let root = workspace_root();
+    let manifest = read(&root.join("crates/rsscript-sdk/Cargo.toml"));
+    let lockfile = read(&root.join("Cargo.lock"));
+    let dev_dependencies = manifest
+        .split("[dev-dependencies]")
+        .nth(1)
+        .and_then(|section| section.split("[[test]]").next())
+        .expect("SDK manifest must contain a bounded dev-dependency section");
+
+    assert!(
+        !dev_dependencies.contains("../../experiments/"),
+        "the SDK test closure must not pull experiments; integration tests belong to the experiments workspace"
+    );
+    for package in ["name = \"reir\"", "name = \"rsscript-review-reir\""] {
+        assert!(
+            !lockfile.contains(package),
+            "Core lockfile must not retain SDK-only experimental package `{package}`"
+        );
+    }
+}
+
 #[test]
 fn research_fixtures_are_owned_by_the_experiments_boundary() {
     let root = workspace_root();
@@ -2147,24 +2170,18 @@ fn native_package_dependency_model_is_not_owned_by_aot_lowering() {
                 .contains("rsscript_package_review::package_sources_with_dependency_interfaces"),
         "compiler source-list compatibility must delegate presentation to the package-review boundary"
     );
-    let mut remaining_compiler_package_files = std::fs::read_dir(
-        root.join("crates/rsscript-compiler/src/package"),
-    )
-    .expect("compiler package directory")
-    .map(|entry| {
-        entry
-            .expect("compiler package entry")
-            .file_name()
-            .into_string()
-            .expect("UTF-8 compiler package filename")
-    })
-    .collect::<Vec<_>>();
-    remaining_compiler_package_files.sort();
-    assert_eq!(
-        remaining_compiler_package_files,
-        vec!["authorization.rs", "metadata.rs", "native.rs"],
-        "compiler package compatibility may retain only authorization, legacy lowering metadata, and trusted native-wrapper adapters"
-    );
+    for forbidden in [
+        "package::review",
+        "package::policy",
+        "package::source_set",
+        "package::graph",
+        "package::lock",
+    ] {
+        assert!(
+            !package_module.contains(forbidden),
+            "compiler package compatibility must not expose retired `{forbidden}` behavior"
+        );
+    }
     for removed in ["mod policy;", "mod review;", "mod source_set;"] {
         assert!(
             !package_module.contains(removed),
@@ -5797,8 +5814,12 @@ fn github_workflows_follow_current_workspace_boundaries() {
     }
 
     let release = read(&workflow_dir.join("release.yml"));
-    assert!(release.contains("for PACKAGE in rsscript-cli reir"));
-    assert!(!release.contains("for PACKAGE in rsscript reir"));
+    assert!(release.contains("for PACKAGE in rsscript-cli; do"));
+    assert!(!release.contains("for PACKAGE in rsscript-cli reir"));
+    assert!(
+        !release.contains("Validate native JIT") && !release.contains("--bin reir -p reir"),
+        "the Core release path must not validate or package experimental backends"
+    );
     for target in [
         "x86_64-unknown-linux-gnu",
         "aarch64-apple-darwin",

crates/rsscript-sdk/tests/architecture.rs

@@ -26,7 +26,7 @@ When documents disagree, use this order:
 | [releasing.md](releasing.md) | Multi-platform binaries, dry-run, provenance, and SDK distribution |
 | [package.md](package.md) | Implemented package artifacts, commands, review model, and trust boundary |
 | [architecture/ARCHITECTURE.md](architecture/ARCHITECTURE.md) | Module ownership and dependency rules |
-| [architecture/migration-baseline.md](architecture/migration-baseline.md) | Review convergence TODO, migration invariants, and mechanical exit criteria |
+| [architecture/migration-baseline.md](architecture/migration-baseline.md) | Historical migration evidence and retained regression fixtures |
 | [development/DEVELOPMENT.md](development/DEVELOPMENT.md) | Local development and verification |
 | [development/DOCKER.md](development/DOCKER.md) | Containerized development |
 | [self-hosting.md](self-hosting.md) | Experimental self-hosting goal, current coverage, and validation contract |

docs/README.md

@@ -0,0 +1,41 @@
+# ADR 0226: Post-migration product contracts
+
+- Status: Accepted
+- Date: 2026-08-16
+
+## Context
+
+The compiler-purity migration is complete. Keeping migration adapters, two
+bytecode directions, and experimental backends indefinitely in the normal
+product path would make every future change pay compatibility and backend costs
+that ordinary embedders do not need.
+
+## Decisions
+
+1. The Core product path is immutable capture, frontend validation, typed MIR,
+   `rsscript.bytecode.v1`, verification, host admission, Provider linking, and
+   bounded VM or isolated-runner execution.
+2. `rsscript.bytecode.v2` is a bounded numeric verifier prototype. It has no VM
+   execution path, writer, or public deployment promise until a follow-up ADR
+   defines its complete cutover: emitter, verifier, VM decoder, SDK/CLI use,
+   v1 read-only fixtures, and v1 writer removal.
+3. The runner profile is a host-owned deployment object. It selects installed
+   Providers, limits, admission, and isolation controls. It does not take part
+   in parsing, type checking, lowering, or Artifact identity. Its non-secret
+   identity and descriptor digest are execution evidence.
+4. Artifact digests establish content integrity and provenance binding. Origin
+   authentication remains an optional `ArtifactAdmissionPolicy` responsibility;
+   no signing hierarchy or language-level authorization system is introduced.
+5. AOT, JIT, REIR, native plugins, and self-hosting are external experimental,
+   integration, or research consumers. They may depend on stable Core contracts
+   but must not be selected by default SDK, VM, CLI, or release validation.
+6. Compatibility APIs are transitional. New code uses canonical SDK modules and
+   `WireValue`; compatibility stays explicitly feature-gated while the removal
+   corpus is migrated.
+
+## Consequences
+
+The active engineering goal is contraction: remove compatibility call paths and
+experimental reverse dependencies before adding syntax, providers, bytecode
+formats, or backends. The completed migration checklist remains historical
+evidence; durable invariants belong in architecture tests and ADRs.

docs/architecture/adr/0226-post-migration-product-contracts.md

@@ -3,6 +3,11 @@
 RSScript publishes four independent versioned contracts. Compatibility is
 checked before Provider linking or execution.
 
+The language specification filename is a document revision, not a fifth runtime
+version. `RSScript_v0.7_Spec.md` is currently the normative text for the
+`0.1.x` language-semantics line below; Artifact, runtime, and Provider versions
+remain independent compatibility contracts.
+
 | Contract | Current line | Compatibility rule |
 | --- | --- | --- |
 | Language | `0.1.x` | A compiler/runtime accepts only its own pre-1.0 minor line. |

docs/compatibility.md

@@ -1,8 +1,8 @@
 # Development Rules
 
-RSScript development is spec-first and self-hosted-validation-driven. The goal is not to
-accumulate many small fixtures; the goal is to make the language capable of
-reviewing and eventually implementing its own core tooling.
+RSScript development is spec-first and product-contract-driven. The goal is not
+to accumulate fixtures or backend experiments; it is to keep one small,
+deterministic compilation and execution path correct and auditable.
 
 ## Implementation Discipline
 
@@ -13,12 +13,12 @@ reviewing and eventually implementing its own core tooling.
    the feature. Do not encode a one-off lowering shortcut, fixture-only bypass,
    or runtime fallback that preserves a different language model.
 
-2. Treat self-hosted validation and implementation as one loop.
+2. Treat self-hosted validation as Research evidence, not as a product driver.
 
-   A useful self-hosted validation file should model a real RSScript tool concern: review-map
-   classification, diagnostics, package contract review, source-map remapping,
-   lowering facts, or package risk. If self-hosted validation reveals an unsupported shape, fix
-   the parser/checker/lowering/runtime layer that is actually missing.
+   A useful self-hosted validation file may model a real RSScript tool concern:
+   diagnostics, source-map remapping, lowering facts, or package analysis. It
+   must not expand source syntax, Core ABI, or the formal release path merely to
+   improve self-host parity.
 
 3. Do not treat unknown as safe.
 
@@ -64,10 +64,9 @@ reviewing and eventually implementing its own core tooling.
    semantic boundaries.
 3. Rust lowering, source maps, and rustc diagnostic remapping for already
    supported source constructs.
-4. Self-hosted validation programs that implement RSScript review/package/diagnostic logic in
-   RSScript and keep review-map unknown low.
-5. Review map and semantic diff quality.
-6. Package manager surface area after the underlying language behavior is hard.
+4. Semantic-fact and execution-report quality.
+5. Provider conformance and isolated-runner boundary hardening.
+6. Research validation only when it protects an existing Core invariant.
 
 ## Testing Loop
 
@@ -80,7 +79,7 @@ set process-wide JIT configuration.
 docker compose run --rm dev cargo test -p rsscript-compiler --no-run
 docker compose run --rm dev cargo test -p rsscript-compiler
 docker compose run --rm dev cargo clippy -p rsscript-sdk --tests -- -D warnings
-docker compose run --rm dev cargo test -p rsscript-compiler --features native-jit --no-run
+docker compose run --rm dev cargo test --manifest-path experiments/Cargo.toml -p vm-jit --no-run
 ```
 
 If a broad target fails, run the specific failing test while editing. After the
@@ -114,7 +113,7 @@ Before committing a semantic change, run the full local gate:
 
 ```sh
 docker compose run --rm dev cargo clippy -p rsscript-sdk --tests -- -D warnings
-docker compose run --rm dev cargo test -p rsscript-compiler --features native-jit --no-run
+docker compose run --rm dev cargo test --manifest-path experiments/Cargo.toml -p vm-jit --no-run
 docker compose run --rm dev cargo test -p rsscript-compiler
 git diff --check
 ```

docs/development/DEVELOPMENT.md

@@ -11,11 +11,11 @@ Supported binary targets are:
 
 | Target | Runner | Assets |
 | --- | --- | --- |
-| `x86_64-unknown-linux-gnu` | Ubuntu 24.04 | `rss`, `reir` |
-| `aarch64-apple-darwin` | macOS 14 | `rss`, `reir` |
-| `x86_64-pc-windows-msvc` | Windows 2025 | `rss.exe`, `reir.exe` |
+| `x86_64-unknown-linux-gnu` | Ubuntu 24.04 | `rss` |
+| `aarch64-apple-darwin` | macOS 14 | `rss` |
+| `x86_64-pc-windows-msvc` | Windows 2025 | `rss.exe` |
 
-Tags must exactly match the `rsscript-cli` and `reir` Cargo versions. Accepted
+Tags must exactly match the `rsscript-cli` Cargo version. Accepted
 forms are `vX.Y.Z`, `vX.Y.Z-alpha.N`, `vX.Y.Z-beta.N`, and `vX.Y.Z-rc.N`.
 Pre-release tags are marked as GitHub pre-releases and never become `latest`.
 

docs/releasing.md

@@ -27,28 +27,28 @@ language specification and tests remain authoritative for existing behavior.
    Cargo metadata tests now reject any VM dependency on compiler, syntax,
    semantics, or lowering internals.
 
-## Current priority: conformance and boundary hardening
-
-The checked migration baseline and package maturity inventory live in
-[`architecture/migration-baseline.md`](architecture/migration-baseline.md) and
-[`architecture/workspace-tiers.toml`](architecture/workspace-tiers.toml).
-The baseline's **Review convergence TODO** is the authoritative itemized
-checklist and defines the mechanical completion criteria for this migration.
-
-1. Preserve the checked diagnostics, Artifact, execution, cancellation, and
-   Provider baselines while responsibilities move.
-2. Move remaining ownership/resource/call checks behind the semantic query
-   boundary. Immutable snapshots, `SemanticDatabase`, `AnalysisResult`, and
-   `ValidatedProgram` are now owned by `rsscript-semantics`.
-3. Continue reducing compatibility-crate API and crate-wide lint exceptions.
-4. Extend the query-level language-service cache only with measured editor
-   workloads; formatting, lint, symbols, dependency discovery, and semantic
-   diagnostics now invalidate independently.
-5. Use the exact reachable-value live-memory metric and cumulative allocation
-   quota together in workload tuning; extend the model only when a new VM-owned
-   value kind is introduced. Provider-owned memory remains Provider telemetry.
-6. Promote a feature only through the maturity matrix; do not add syntax while a
-   Core row remains partial.
+## Current priority: product-contract convergence
+
+The compiler-purity migration is complete. Its checked baseline is retained as
+historical evidence, not as the active roadmap. The active work is to make the
+existing Core path smaller, explicit, and usable without exposing migration
+adapters.
+
+1. Retire compatibility-only SDK and Provider paths behind an announced,
+   tested removal plan. New embedding and Provider examples must use canonical
+   `WireValue` APIs only.
+2. Keep experiments one-way consumers of Core contracts. AOT, JIT, REIR, and
+   self-hosting must not become default SDK, VM, CLI, or release dependencies.
+3. Make one bytecode contract executable at a time. `rsscript.bytecode.v2` is a
+   verifier-only prototype until an ADR-defined VM cutover; v1 remains the sole
+   deployed execution schema.
+4. Keep host deployment choices outside language validity and Artifact identity.
+   The runner's host-selected profile performs admission, Provider installation,
+   limits, and isolation; its non-secret identity is recorded in the response.
+5. Maintain a short golden path: capture, build, verify, inspect, default
+   isolated run, and machine-readable execution report.
+6. Promote any feature only through the maturity matrix and measured workloads;
+   do not add syntax while a Core row remains partial.
 
 ## Frozen scope