feat(launcher): opt-in Rust engine behind the existing launcher (#262 Stage 1)

[PhysShell]

Что и зачем

#262 Stage 1 — the Rust core becomes selectable behind the existing launcher, and nothing else moves. Python remains the default and the reference on every surface; nothing public defaults to Rust; Python distribution is untouched. This is explicitly not the cutover — that stays behind Gate G3.

Base is the Checkpoint-0 baseline 46a0d8a167bdfebd184763eb5589c7643083904c.

What lands, by ratified constraint:

• D1 — one explicit launcher selector --engine python|rust|compare on all four production launcher surfaces (owen check, scripts/own-check.sh, scripts/own-check.ps1, action.yml). The Action exposes it as an engine input and delegates the semantics to own-check.sh rather than re-implementing them, so the real fan-out is smaller than four and there is one contract to keep true. own-cli gets no selector (C-4).
• D3/D3.1 — Rust/compare resolve the candidate from OWEN_RUST_CORE and nothing else: no PATH discovery, no rust/target probing, no "first binary found". A missing, empty, nonexistent, non-file or non-executable locator, detected before the selected core starts, is a configuration error — public exit 2, one actionable diagnostic, never a fallback.
• D5 — an unexpected Rust child status takes Owen's internal-error path (5) with the raw status retained in the diagnostic report's typed nullable child_exit_code; report schema bumped to 2. 70 is the engines' shared internal-error code: known, still a failure, never read as findings or clean.
• D4/D4.1 — compare extracts once, captures the OwnIR bytes once, materialises each engine's input from that single value and re-hashes both against it before either engine starts. Streams are compared as raw bytes, not decoded text. Agreement exposes the reference's result; divergence and execution failure both exit 5 with an actionable diagnostic plus reproduction evidence; a zero-document compare fails rather than reporting agreement over nothing.

The ordering finding this stage repairs. CheckCommand.cs resolved Python and unpacked CoreVendor unconditionally, because there was only ever one engine. Engine selection now happens before any engine-specific resolution, and a Rust-only run resolves no interpreter and unpacks no Python core.

No merge authority is claimed. Implement, drive the exact head to a fresh PASS, stop. Merge only under a separate owner instruction bound to the exact reviewed head SHA. A green PR is not merge authority, and a green Stage-1 PR carries no Stage-2 authority.

Тип изменения

• feat — новая возможность
• fix — исправление бага
• docs — документация
• refactor / chore / test / ci — без изменения поведения

Как проверено

The default did not move, and the Rust path needs no Python — measured, not asserted. The sharpest evidence is a single pair of runs against a deliberately broken interpreter:

$ OWEN_PYTHON=/definitely/not/a/python owen check --engine rust <sample>
<sample>/Leak.cs:8: error: [OWN001] IDisposable local 's' is never disposed (leak)
1 finding.
rc=0                      # Rust ran; no interpreter was resolved, no vendored core unpacked

$ OWEN_PYTHON=/definitely/not/a/python owen check <sample>
owen: OWEN_PYTHON='/definitely/not/a/python' did not resolve to Python >=3.11
rc=3                      # the default is still Python, and still fails on Python

The Rust run additionally succeeded on a build with no vendored ownlang-core on disk at all — the pre-Stage-1 launcher could not have.

All eighteen shared adversarial controls pass on BOTH platforms, 0 skipped; 0 not applicable on Linux and 1 on Windows (tests/test_stage1_engine.py, no fail-fast, OWEN_STAGE1_REQUIRE=1; the one N/A is bad-locator-is-2/shell-non-executable, explained below), plus four PowerShell controls (tests/test_stage1_ps1.py) that put own-check.ps1 in the adversarial set for the first time.

ok[bad-locator-is-2]           invalid-locator cases all exit 2, no fallback: 20 on Linux, 18 on
                               Windows, where the shell's non-executable subcase is N/A
ok[absolute-locator-only]      a relative but EXISTING locator is refused, before any extraction
ok[locator-shapes]             8 locator shapes classified as this platform defines them, and
                               every implementation available here agrees
ok[compare-failure-classified] a Python-only failure is execution-failure, not divergence
ok[no-selector-in-own-cli]     own-cli accepts no engine selector, reads no engine environment
ok[default-stays-python]       the default still resolves Python and fails on it (exit 3)
ok[rust-actually-runs-rust]    Rust ran and produced the verdict with Python unusable
ok[rust-failure-no-fallback]   a forced Rust failure produces no verdict on either surface
ok[rc70-is-not-a-verdict]      a Rust child rc 70 takes the public internal-error path (exit 5)
ok[unexpected-rc-maps-to-5]    an unexpected child rc maps to public exit 5
ok[raw-rc-retained]            the raw status is retained as a typed child_exit_code, schema 2
ok[compare-extracts-once]      compare extracted exactly once
ok[compare-same-input]         the candidate received exactly the attested capture
ok[compare-zero-document]      a zero-document compare fails (exit 5) and says so, every surface
ok[divergence-is-5]            a divergence in the bytes alone is exit 5 + reproduction evidence
ok[exec-failure-is-5]          a compare execution failure is exit 5 + failure evidence
ok[compare-no-substitution]    no engine's answer was exposed on divergence or on failure
ok[candidate-identity]         the evidence records the candidate's sha256 and byte length

ok[ps1-absolute-locator]       a relative locator is refused, and the absolute shapes this
                               platform defines are accepted
ok[ps1-not-started-is-2]       an existing-but-unstartable candidate is exit 2 on both paths
ok[ps1-agreement-replays]      agreement replays the reference's RAW BYTES on both streams
ok[ps1-failure-evidence]       the advertised reproduction evidence survives the process

The Windows N/A count fell from four to one. tests/helpers/stage1_stub.rs is a committed, controllable native candidate compiled with plain rustc — no cargo crate, so #261's crate-edge DAG gate is untouched — and it replaces the shebang stubs that had made four compare controls unaskable on Windows. That gap is precisely why three PowerShell defects survived a 16/16 campaign. The one remaining N/A is bad-locator-is-2/shell-non-executable: git-bash runs a mode-644 file with a shebang, so a non-executable candidate cannot be built for the shell surface there; the launcher half of that case does run.

Failures are forced through #261's own off-by-default fault-injection feature against the real production binary, not a mock. compare-extracts-once is behavioural: a dotnet shim on PATH counts extractor invocations, and the count must be exactly 1.

Two mutation campaigns, recorded separately because they are not the same measurement. Both were taken on a clean tree at da897b42fcd7, with every expected catcher hit and the honesty control M00 surviving the unmutated tree:

campaign	where it ran	mutations	result
p022-stage1-1	ubuntu	21	21/21 caught, 0 survived, 0 compile-error, 0 invalid, 0 runner-error
p022-stage1-windows	windows-latest	9	9/9 caught, same

Nothing is added across those rows. A mutant evaluated where its contract cannot be posed is decorative, so the Windows campaign runs the mutants whose contract only Windows can answer: eight target own-check.ps1, and the ninth targets the drive-rooted arm of own-check.sh, which no Linux catcher can reach. Counts are generated into docs/generated/p022-stage1-mutations.md, never typed.

The campaign earned its keep rather than rubber-stamping. Its first run caught only 11/16 and named the hole precisely: the compare and locator controls drove own-check.sh but never the owen launcher, so every C#-side misreading was invisible. Fixing that also exposed a real production inconsistency, where own-check.sh named the input digest on stderr while the launcher printed only the evidence file's path. A second round showed compare-no-substitution was too weak — D4.1(b) exposes neither engine's verdict on divergence, so "Python is the reference, trust it" is the same failure as trusting the candidate; the control was strengthened rather than the expectation lowered.

• python tests/test_stage1_engine.py — 18/18, 0 skipped, 0 N/A on Linux; 18/18 with 1 N/A on Windows
• python tests/test_stage1_ps1.py — 4/4, 0 skipped, 0 N/A on both platforms
• ruff check . — All checks passed; mypy --strict ownlang — Success
• python scripts/render_checkpoint_status.py --check — fragments in sync
• python scripts/mutate_campaign.py --campaign docs/evidence/p022-stage1-1.json --run — 21/21
• the same runner on docs/evidence/p022-stage1-windows.json, on a Windows runner — 9/9
• python tests/run_tests.py — clean
• bash -n on both shell scripts; PowerShell AST parse on own-check.ps1; YAML parse on ci.yml and action.yml

What the Windows leg found

Getting the Windows leg green took six rounds, and it earned its place. Three genuine product defects, none of them reached by the Linux evidence and gates that existed before it. That is the claim, and it is narrower than "Linux could not have found them": defect 3 below is PowerShell semantics, which a Linux pwsh leg under a strict caller could in principle have caught. No such leg existed.

1. A latent pre-existing defect. The repository had no .gitattributes, and this is the first job that has ever run own-check.sh on a Windows runner (the three existing users are ubuntu-only). A Windows checkout rewrote it to CRLF and git-bash could not run it. Fixed with a deliberately narrow *.sh text eol=lf — a blanket * text=auto would put this repository's byte-sensitive evidence at the mercy of a checkout setting, and P-022 step 7a: add dual-engine shadow mode and zero-diff reproduction artifacts #260's wider .gitattributes tail stays untouched.
2. A real gap in D3.1's seam. Windows has no execute bit, so a non-runnable candidate passed the locator, was spawned, and died as exit 5. D3.1 draws its line at starting: a candidate that never started is a configuration error. Spawn failure now maps to exit 2 on the launcher (a typed exception) and in the shell (bash's 126/127).
3. own-check.ps1 emitted PowerShell ErrorRecords via Write-Error. A caller running $ErrorActionPreference = 'Stop' — exactly how GitHub's pwsh shell runs — turns those into terminating errors in the caller, despite the script having handled the condition and exited deliberately. It now writes stderr text, as own-check.sh always did. Verified locally under a strict caller.

One documentation error of mine, corrected by measurement. I had written that Windows compare diverges "for non-ASCII output". It diverges on every run: the Python reference writes CRLF where Rust writes LF, so pure-ASCII findings already differ byte for byte. Both the launcher README and the CompareMode contract comment now say so, and separate line endings (all output) from encoding (non-ASCII only). This was only visible because compare captures raw bytes — a string comparison through one .NET encoding would have normalised CRLF away and reported agreement, hiding a declared difference behind a green control.

Three further causes were harness bugs, fixed in the controls: subprocess.run(["bash", ...]) on a Windows runner resolves to WSL's bash.exe stub in System32; a child status is spelled three different ways across runtimes (-6 / 134 / 3221226505 / -1073740791); and GitHub's pwsh wrapper appends exit $LASTEXITCODE, so a step inherited the exit code of a case it was written to require.

CI gains a stage1-engine job on ubuntu and windows: both platforms because the ratified evidence is explicit Rust-selected runs on each, and they differ in exactly the mechanics (process launch, executable bits, path forms) a Linux-only job leaves unproven. The Windows leg additionally drives own-check.ps1's engine contract, which no Linux leg reaches.

The REQUEST CHANGES repair

Five production defects were reported, all five verified against primary source before anything was touched, all five real. A sixth was found while proving the fourth: Start-Process -RedirectStandardOutput is not byte-faithful — measured on one input, the Python reference wrote 211 bytes and the redirected file held 210, a blank line silently dropped. Compare claims the two engines' public bytes are identical, so a lossy capture of the reference can manufacture a divergence that does not exist or hide one that does.

The review also required that a mutant targeting own-check.ps1 be killed by a Windows catcher, since a Linux leg cannot pose the question. Honouring that turned up three more defects that no Linux control could have seen, and each one is an argument for the rule rather than a compliance step:

1. The shell's absoluteness test matched nothing. My own fix for defect 1 wrote the drive-rooted arm as [A-Za-z]:[/\]*. Inside a bracket expression the shell's matcher treats the backslash as an escape, so \] escaped the closing bracket, the set was never terminated, and the arm matched neither C:/ nor C:\. Every correct Windows configuration was refused as "not an absolute path". Nothing caught it because every assertion asked one direction — is a relative locator refused? — and a validator that refuses everything answers that perfectly. locator-shapes now asserts both directions across every implementation on the host, and fails when two of them disagree about a shape.

2. own-check.ps1 asked the platform to OPEN its candidate, never to run it. PowerShell's call operator does not spawn a program. On Linux a non-runnable candidate went to xdg-open; on the Windows runner it opened in notepad, and the job's own cleanup line terminated it. Either way the run exited 0 with empty streams: a clean, finding-free analysis of nothing, which is worse than any wrong exit code. D3.1's seam was unreachable on both platforms, so the try/catch added for defect 3 could never fire. The candidate is now started with UseShellExecute = $false, and the control that had been declared Linux-N/A is required on both platforms again — that N/A was describing a bug in this script, not a property of Linux.

3. A campaign definition hashed differently on the two platforms. core.autocrlf=true is the Git for Windows default, so the runner checked the definition out with CRLF and the recorded sha256 read the checkout setting rather than the campaign. A run that measured exactly the right tree was filed as evidence for a different one, and the gate was right to refuse it. docs/evidence/*.json text eol=lf pins the bytes that are the contract.

Two harness rules changed with them. A control that raises is now that check's failure rather than the suite's: an unhandled exception had aborted the PowerShell suite mid-run, so the two controls after it never ran and the campaign saw one nameless failure where it needed a named catcher. And a voided campaign now names the checks that voided it, which took two CI rounds to establish by hand while the runner had the names all along.

The second REQUEST CHANGES round

Two proof gaps and two truth-surface contradictions, all four found by review against primary source rather than by anything here.

1. The stderr half of "both streams" was never compared. The agreement control guarded its stderr assertion with if ref.stderr, and a healthy python -m ownlang ownir writes none — CI printed 184 out, 0 err on Windows and 160 out, 0 err on Linux while the control reported it had checked both. A guard that switches an assertion off exactly when the data is ordinary is a hole with a denominator of zero. The fixture is now built rather than found: own-check.ps1 resolves the reference as a bare python, so a shim directory whose python is the committed native stub makes the reference's bytes choosable, and both engines then agree over a fixture whose stderr is deliberately non-empty (CRLF a text pipeline would rewrite, multi-byte UTF-8 a re-encode would normalise). The old real-reference fixture is kept beside it — only that one proves the replay is faithful to the actual implementation. P03 is now scoped to stdout and P08 removes the stderr replay alone; measured separately, they die for different reasons under the same catcher.

2. The PowerShell surface never proved D3's preflight POSITION. The shared harness counts extractor invocations, but its counter is a #! script installed only off Windows — so on the one platform whose campaign is the record there was no counter at all, and a validator that drifted to after extraction would still exit 2, still name the absolute requirement, still emit no verdict. There is a counter on both platforms now (a .cmd on Windows, since own-check.ps1 reaches dotnet through the call operator and that honours PATHEXT), and P09 is the mutant it exists to kill. It counts extractions, not every dotnet invocation, and that distinction was measured rather than assumed: where pwsh is installed as a dotnet global tool, merely starting the shell invokes dotnet twice, so a count-everything assertion fails there and passes on the Windows runner — the same shape of mistake as the xdg-open near-miss above.

3. This body claimed two different N/A denominators. It said "0 not applicable" on both platforms and, twelve lines later, "1 N/A on Windows". CI says the second. Corrected above.

4. RustCoreLocator documented the D3.1 seam backwards. IsExecutable said a Windows broken image "already maps to the internal-error path"; it maps to exit 2, because EngineRunner raises RustCoreNotStartedException and CheckCommand returns RustCoreLocator.ExitCode. A candidate that never started never ran and cannot have misbehaved. The comment below it was wrong for the same reason and is fixed with it.

The recorded provenance names da897b42fcd7; the head is one commit later and changes only the two .result.json files and the generated fragment, so production did not move after it was measured. The Windows record is the push run's — the pull_request job recorded GitHub's synthetic merge commit, which exists in no branch.

Связанные issue

Refs #262 (Stage 1 of four; #262 stays open through Stage 4), #261, #250, #260. Closes nothing.

Чеклист

• изменение покрыто тестом/селфтестом — twenty-two adversarial controls across two harnesses, plus two mutation campaigns (21 on Linux, 9 Windows-native) proving they are load-bearing
• README/docs обновлены — P-022 row 8 and the preferred queue, the proposals index, rust/README.md, and the launcher README (user-facing engine docs + the explicit rollback)
• коммиты в conventional-commit стиле

---

Generated by Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 7bac9c05-2ccd-437b-ab72-3fa8922cd9ab

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}