Evaluate generated XMD text with constrained authority

[taras]

Story

Authors can evaluate generated XMD program text explicitly, without turning <Plan> into execution or introducing a second kind of complete document.

<Plan as="program">Ask for the user's age.</Plan>
<Evaluate text={program} allow={["read"]} as="result" />

The paired form is the direct common path:

<Evaluate allow={["read"]}>
  <Plan>Ask for the user's age.</Plan>
</Evaluate>

<Plan> is generative quotation: it produces inert XMD fragment text. <Evaluate> is the operation that evaluates that text.

Approved component descriptions:

Generate program text from a prompt. <Plan as="program">Ask for the user's age.</Plan> produces a string that can be passed to <Evaluate>.

Evaluate program text. <Evaluate text={program} allow={["read"]} /> runs it.

Current gap

Workflow-generated XMD can be evaluated through the older source surface, while ordinary runs lack the same author-visible operation. The shipped workflow component is also replaceable by ordinary component resolution. A replacement can ignore allow and use wider site authority, so the restriction is not trustworthy if the name remains replaceable.

PR #756 began filling the broader gap with a complete-program abstraction, but that model has been superseded. Fragments use the established generated-XMD boundary and the authority of their evaluation site.

Observable contract

• <Evaluate text={program} allow={...} /> supplies exact text directly.
• Paired <Evaluate allow={...}>...</Evaluate> privately renders its content as the text to evaluate; wrapper framing is not part of the text.
• The two forms are disjoint. Supplying both, supplying neither, or supplying invalid allow refuses before paired content or fragment effects run.
• allow governs evaluation of the resulting text, not the operations used to produce paired content.
• Omitted allow means read.
• The text is an XMD fragment at the current site. It creates no root frontmatter, root props, root returns, or independent <Output> selection.
• <Evaluate> returns { observations, output }. as captures that object; without as it is discarded. Evaluation does not emit the fragment output into the enclosing document.
• There is no <Program>, <Source>, or <Execute> component.

Protected ownership

<Evaluate> is a public, engine-owned component in the canonical protected tier established by #758. Any author may invoke it. Canonical core owns the name, input grammar, fragment admission, allow interpretation, result shape, and invocation identity.

A repository component, workflow bundle member, declared Markdown component, ordinary or reserved registration, Component.importComponent middleware answer, document-authored context value, or implementation from another loaded package copy cannot answer for or replace it. Middleware may observe, delegate, or refuse a protected import, but cannot supply, alter, redirect, retain for reuse, or invoke a replacement.

Protection determines which <Evaluate> implementation runs. It grants no authority. Each trusted host supplies one private fragment-evaluation profile to canonical execution before document code runs. That profile sets the maximum authority and contains the exact component identities and forms, request limits, retained-root access where applicable, and provider operations the host exposes. A missing or duplicate profile refuses evaluation before producer or fragment work. allow then selects from that profile and can only narrow it.

Structural constructs remain protected by structural dispatch rather than the component tier. Ordinary defaults such as <File>, <Fetch>, and <Elicit> remain replaceable at ordinary authored sites. A fragment executes only an identity and authored form that its trusted evaluation profile admitted and the durable admission retained.

Authority

allow narrows authority supplied by the host. Text never grants authority.

For the standard ordinary-run and workflow-run profiles, read selects exactly self-closing <File>. write selects exactly paired <File>, paired <Dir>, and self-closing <File.Delete>; it does not implicitly select read. An author needing both writes allow={["read", "write"]}. The ordinary profile resolves those operations through its Files provider; the workflow profile resolves them against the retained Workspace through its transaction-bound Files provider.

<Fetch> may be a read entry only when the host supplies exact trusted request limits. Any further entry is an explicit trusted-host table extension retained as part of the policy. Agent, elicitation, Git, issue, process, executable, credential, and other host-private authorities are absent from the standard tables.

The complete fragment is preflighted against the selected vocabulary before its first effect. Invalid syntax, unavailable components or forms, root-only constructs, changed trusted limits, and unavailable authority fail closed.

Plan syntax

Merged PR #759 supplies public protected <Syntax> throughout XMD. The packaged Plan invokes that component and carries no private Syntax implementation.

After form, allow, and host-profile validation select the exact table, <Evaluate> derives a narrower syntax reference from that table and installs it while paired content is rendered and while the resulting fragment is evaluated. A directly nested Plan and bare <Syntax /> inside the fragment therefore receive exactly the components and control-flow constructs that preflight will admit.

Named <Syntax names={...} /> reads documentation from the enclosing authoring reference and renders whether each selected component is available in the current evaluation. It may explain a component that the narrowed evaluation cannot execute; reading that explanation never admits the component.

A directly nested Plan receives the narrowed executable vocabulary and can request selected reference material through public Syntax before admission. Preflight validates its generated text against the same table before effects.

A deferred <Plan as="program"> reads the ordinary authoring symbols at its own site because it cannot know a future evaluation site. A later <Evaluate> validates the exact text against its own selected vocabulary before effects.

Durability and replay

Generalize the existing generated_xmd boundary. Do not retain the parallel complete-root evaluate_program abstraction.

New executions write a closed version-2 generated-XMD record containing exact text, selected policy and trusted limits, occurrence identity, admitted evaluation-site component identities, and the committed observations, output, effects, and outcome required for replay. Existing untagged #369 records remain readable as version 1.

Continuation compares exact text, policy, trusted limits, and admitted identities before effects. It replays committed work without repeating planning or completed effects. Malformed or hostile records, stale inputs, and changed identities refuse before fragment effects.

An admissible ordinary middleware answer supplies a stable namespaced provider origin, component key, and revision for the actual answer. Resolve each exact source occurrence once through the ordinary import chain, retain that identity, and execute only the admitted answer. Do not infer it from replaceable definition fields, function identity, a context name, or an independent selection. Provider registrations belong to the evaluation scope and are revoked at teardown; competing resolution claims are occurrence-settled.

Cancellation stops active producer or evaluation work, waits for complete teardown, and only then settles the outcome. A continuation never resumes through an uncommitted partial effect.

Compatibility

text is canonical everywhere. The released workflow-only source prop remains a silent deprecated compatibility alias in the workflow profile. There it is mutually exclusive with text and paired content and otherwise has identical evaluation, authority, result, and journal behavior. The ordinary profile rejects source rather than acquiring a legacy spelling it never shipped.

Approved Syntax documentation wording for source:

Deprecated compatibility spelling for workflow documents. Use text in new documents.

Removing source requires a separate versioned migration story. The unmerged program spelling is removed without an alias.

Acceptance

1. Direct text and paired content evaluate the same exact fragment and return the same { observations, output } result.
2. Invalid or combined inputs and invalid policy refuse before producer or fragment effects, with explicit negative controls.
3. Ordinary and workflow profiles prove the exact read and write tables, their union, and denied near-neighbors; write alone cannot read and text never grants authority.
4. Root-only frontmatter, props, returns, and independent <Output> selection refuse before effects.
5. Bare Syntax and direct Plan receive the admitted executable vocabulary without a private implementation; named Syntax reads enclosing-site documentation while marking current availability, and deferred Plan keeps its own-site vocabulary before later preflight.
6. Exact text and policy survive continuation; stale input or policy refuses; committed Plan and fragment work do not repeat.
7. Hostile durable records fail closed; old Evaluate Agent-generated XMD through a constrained allowlist #369 records remain readable and new records use the closed version-2 form.
8. Declared-component private closures and producer-private authority do not leak into evaluation.
9. Middleware answer A resumes unchanged; substitution with B refuses before either runs. Provider teardown and losing or cancelled claimant controls prove isolation.
10. Repeated Evaluate occurrences cannot consume one another's records, and actual cancellation completes cleanup before settlement.
11. Workflow source and canonical text are equivalent without a warning; ordinary evaluation rejects source, and every profile rejects program.
12. Ordinary and workflow hosts exercise the same fragment evaluator, and xmd plan output gains no special complete-root type.
13. Repository, bundle, declaration, ordinary and reserved registration, middleware, context, and cross-copy replacement attempts cannot answer for <Evaluate>. Honest delegation reaches canonical core and a deliberate middleware refusal remains a refusal.
14. A replacement designed to ignore allow={["read"]} and perform a write is never invoked; canonical Evaluate refuses the write before a provider call or mutation.
15. Protection adds no authority: a profile without write remains unable to write, and the protected name adds no entry to allow.
16. Structural constructs remain structural, while ordinary repository replacements for File, Fetch, and Elicit still win outside the admitted fragment boundary.
17. Source, npm, and compiled symbols report Evaluate under protected origin with the approved description.
18. Each execution accepts one private evaluation profile; missing, duplicate, or document-forged profiles refuse before producer or fragment effects.

Every refusal row includes a negative control proving that no producer, replacement, provider request, file mutation, or other fragment effect occurred.

Delivery

PR #759 is merged. Correct PR #756 from a clean worktree based on the latest main containing that merge. Do not use an obsolete exact commit from the earlier complete-program implementation as the base. Retain only the durability and isolation work that supports this fragment contract, remove complete-root machinery, run the focused cross-boundary evidence, and return a signed feedback commit promptly without waiting for CI.

#762 then uses this public Evaluate boundary for bounded read-only information requests during xmd plan authorship.