meta.language.envelopes.direct_calls

Each invocation clause grants a direct dependency. Transitive reachability is derived from those direct edges and does not grant the caller permission to invoke an indirect dependency directly.

Read in specification context · design/meta/language.md

Tests and review

Indexed tests and the implementation-completeness and test-adequacy review; no test run is implied.

Implemented sage_meta::indirect_reachability_does_not_grant_a_direct_call_permission

crates/sage-meta/tests/envelopes.rs · test:envelopes

#![allow(unused)]
fn main() {
#[test]
#[sage::test(meta.language.envelopes.direct_calls)]
#[sage::test(meta.language.model.forbidden_paths)]
fn indirect_reachability_does_not_grant_a_direct_call_permission() {
    let source = r#"class Root { """Root.""" fn run() -> u32 { """Run.""" envelope {
            invokes crate::Helper::work();
        } } }
        class Helper { """Helper.""" fn work() -> u32 { """Work.""" envelope {
            invokes crate::Leaf::read();
        } } }
        class Leaf { """Leaf.""" fn read() -> u32 { """Read.""" envelope {} } }"#;
    let model = Arc::new(ContractModel::new(&[valid(source)]).unwrap());
    assert_eq!(
        model.operations()["demo::Root::run"].invokes[0].targets,
        ["demo::Helper::work".into()].into_iter().collect()
    );
    let mut session = ContractSession::new(model, ["demo::Root::run".into()]);
    let root = session.enter("demo::Root::run", None);
    let indirect = session.enter("demo::Leaf::read", None);
    session.exit(indirect);
    session.exit(root);
    assert_eq!(
        session.finish().violations[0].kind,
        ViolationKind::UndeclaredCall
    );

    let prohibited = source.replace(
        "invokes crate::Helper::work();",
        "invokes crate::Helper::work(); forbid transitive crate::Leaf::read;",
    );
    let errors = sage_meta::validate(&[parse(&prohibited)]);
    assert!(errors.iter().any(|error| {
        error
            .message
            .contains("demo::Root::run -> demo::Helper::work -> demo::Leaf::read")
    }));
    valid(&prohibited.replace("invokes crate::Helper::work();", ""));
}
}

See more source ↗

Review: Accepted · Codex /root/anchor_195.

Reassessed all three requirements: invocation clauses grant direct edges, reachability derives from those edges, and indirect reachability does not authorize a direct request. Both ordinary implementation entries are covered: validate.rs resolves each explicit invocation into its own CallPermission without traversing callees, and independently builds/traverses the direct graph for forbidden transitive paths; contracts.rs check_request checks only the active caller contract targets (with declared dispatch handling), never a transitive permission closure. The sole ordinary associated test, indirect_reachability_does_not_grant_a_direct_call_permission, asserts Root has only Helper as its invocation target, observes UndeclaredCall for Root directly entering Leaf, asserts the derived Root -> Helper -> Leaf forbidden path, and removes Root’s direct edge to demonstrate that the prohibition no longer has reachable evidence. Captured parse/valid helpers confirm the final case actually asserts successful validation. These assertions would detect flattening indirect reachability into Root’s permissions or ignoring the direct edges in graph derivation. No TODO/N/A entries or deferred prerequisites exist. Baseline verification: contracts.rs, validate.rs, and envelopes.rs exactly match the historical source arrays byte for byte; the supplied earlier independent rationale remains supported by current complete claim, both implementation files, complete associated test, and captured helpers. This is source review, not fresh behavior execution. I ran review start, review read, and the baseline comparison; no tests or build were rerun. The coordinator separately reports 321 passing functional tests and a successful root build. No source edits requested.

Browse meta anchors

116 anchors

Anchor Implementation Tests

meta (116) 102 Implemented24 TODO 103 Implemented36 TODO

meta.anchors (22) 22 Implemented 21 Implemented12 TODO

anchor_pages Implemented ImplementedTODO

Every specification anchor has a stable page identifying the rule and showing its definition, context, implementation entries, and tests/evidence. The page includes Rust excerpts and access to surrounding source, and exposes each entry’s placeholder status and explanation. Multiple sites remain individually inspectable rather than being reduced to a single coverage badge.

Symposiun AGentic Environment (SAGE)

meta.language.envelopes.direct_calls

Implementation

Tests and review