M2 slice 1: opt-in application-root commitment profile (experimental, off by default)

.github/workflows/ci.yml

@@ -197,6 +197,8 @@ jobs:
               run: cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime --test scene_fixture_tests --bench scene_fixtures -- -D warnings -D missing_docs
             - name: cargo clippy (experimental application root, M1)
               run: cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test,application_root_shadow --lib --tests -- -D warnings
+            - name: cargo clippy (experimental application-root commitment profile, M2)
+              run: cargo clippy -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test,application_root_profile --lib --tests --benches -- -D warnings
 
             - name: cargo clippy (compiler-produced pure evaluation)
               run: cargo clippy -p warp-core --features trusted_runtime --lib --test edict_pure_evaluation_tests --test edict_pure_predicates_tests --test edict_pure_unsigned_subtraction_tests --test edict_unsigned_addition_tests --test edict_pure_byte_length_tests --test edict_byte_equality_tests --test edict_byte_slice_tests --test edict_node_read_tests --test edict_byte_concat_tests --test edict_byte_literal_tests --test edict_source_functions_tests -- -D warnings -D missing_docs
@@ -393,6 +395,10 @@ jobs:
                   cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime,application_root_shadow --test scene_fixture_tests
                   cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test,application_root_shadow --lib application_root
                   cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime,application_root_shadow,delta_validate --test application_root_shadow_tests
+            - name: cargo test (experimental application-root commitment profile, M2)
+              run: |
+                  cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test,application_root_profile --lib application_
+                  cargo test -p warp-core --features native_rule_bootstrap,trusted_runtime,host_test,application_root_profile,delta_validate --test application_root_profile_tests --test trusted_runtime_host_loop_tests --test executable_operation_pipeline_tests
             - name: cargo test (compiler-produced pure evaluation)
               run: |
                   cargo test -p warp-core --features trusted_runtime --test edict_pure_evaluation_tests --test edict_pure_predicates_tests --test edict_pure_unsigned_subtraction_tests --test edict_unsigned_addition_tests --test edict_pure_byte_length_tests --test edict_byte_equality_tests --test edict_byte_slice_tests --test edict_node_read_tests --test edict_byte_concat_tests --test edict_byte_literal_tests --test edict_source_functions_tests

CHANGELOG.md

@@ -347,6 +347,16 @@
   native provider judgments require same-width operands and a dominating
   no-overflow proof, including legacy Core without a function table.
 
+- Experimental feature `application_root_profile` (M2, off by default, implies
+  `application_root_shadow`): a worldline registered with
+  `WorldlineState::with_commitment_profile(CommitmentProfile::ApplicationRadixV0)`
+  commits `H("echo.state-root.application-radix.v0" || application_root)` as
+  its `state_root` instead of walking the graph. Replay, readings at earlier
+  coordinates, forks, initial boundaries, imports and WAL recovery verify
+  under the worldline's profile; a history replayed or recovered under the
+  other profile fails. Worldlines default to `LegacyReachableV1`, whose roots,
+  commit hashes and receipts are unchanged.
+
 - Experimental feature `application_root_shadow` (M1, off by default): an
   incremental application root over every node, edge and attachment record of
   a worldline state, kept beside the legacy state root, which it neither

crates/warp-core/Cargo.toml

@@ -48,6 +48,9 @@ host_test = []
 # EXPERIMENTAL (M1): keep an incremental application root beside the legacy
 # state root, in shadow mode. It changes no root, receipt or wire format.
 application_root_shadow = []
+# EXPERIMENTAL (M2): let a worldline opt into committing the application root
+# as its state root. Legacy worldlines and histories are unchanged.
+application_root_profile = ["application_root_shadow"]
 # TRUSTED HOST ONLY: exposes runtime-owner authority constructors for host
 # adapters that own scheduler/runtime control. Application crates must not
 # enable this feature.

crates/warp-core/benches/scene_fixtures.rs

@@ -60,18 +60,35 @@ fn main() {
     );
 
     for tier in [think_append::S, think_append::M] {
-        run_f5(tier, SEED, ROUNDS);
+        run_f5(tier, SEED, ROUNDS, "legacy-reachable-v1", think_append::run);
+    }
+    // The experimental application-root commitment profile (M2).
+    #[cfg(feature = "application_root_profile")]
+    for tier in [think_append::S, think_append::M] {
+        run_f5(tier, SEED, ROUNDS, "application-radix-v0", |tier, seed| {
+            think_append::run_with_profile(
+                tier,
+                seed,
+                warp_core::application_root::CommitmentProfile::ApplicationRadixV0,
+            )
+        });
     }
 }
 
-fn run_f5(tier: think_append::Tier, seed: u64, rounds: usize) {
+fn run_f5(
+    tier: think_append::Tier,
+    seed: u64,
+    rounds: usize,
+    profile: &str,
+    execute: fn(think_append::Tier, u64) -> think_append::Observation,
+) {
     let spec = think_append::workload(tier, seed);
     let script = think_append::script(tier, seed);
     let digest = hex32(&think_append::script_digest(&script));
     let expect = think_append::expectation(tier, Some(&digest));
     let workload_id = spec.workload_id();
     println!(
-        "F5 tier={} seed={seed} workload_id={} expectation_id={} script_digest={digest}",
+        "F5 tier={} profile={profile} seed={seed} workload_id={} expectation_id={} script_digest={digest}",
         tier.name,
         hex32(&workload_id),
         hex32(&expect.expectation_id(&workload_id))
@@ -96,7 +113,7 @@ fn run_f5(tier: think_append::Tier, seed: u64, rounds: usize) {
     let mut per_append = Vec::new();
     let mut comparable = true;
     for round in 1..=rounds {
-        let obs = think_append::run(tier, seed);
+        let obs = execute(tier, seed);
         let class = think_append::validate(tier, &script, &expect, &obs);
         let a = &obs.accounting;
         println!(
@@ -128,7 +145,7 @@ fn run_f5(tier: think_append::Tier, seed: u64, rounds: usize) {
         let committed = tier.appends as f64;
         let append_p50 = median_ms(appends);
         println!(
-            "F5 tier={} summary valid_rounds={rounds} append_p50_ms={append_p50:.2} \
+            "F5 tier={} profile={profile} summary valid_rounds={rounds} append_p50_ms={append_p50:.2} \
              per_append_p50_ms={:.4} useful_throughput_appends_per_s={:.0} replay_p50_ms={:.2}",
             tier.name,
             median_ms(per_append),
@@ -137,7 +154,7 @@ fn run_f5(tier: think_append::Tier, seed: u64, rounds: usize) {
         );
     } else {
         println!(
-            "F5 tier={} summary withheld: not every round was valid",
+            "F5 tier={} profile={profile} summary withheld: not every round was valid",
             tier.name
         );
     }

crates/warp-core/benches/support/fixtures/think_append.rs

@@ -437,8 +437,26 @@ pub struct Timings {
 
 /// Executes the fixture through the trusted host.
 pub fn run(tier: Tier, seed: u64) -> Observation {
+    run_from(tier, seed, initial_state(tier))
+}
+
+/// Executes the fixture on a worldline with commitment profile `profile`
+/// (M2, experimental).
+#[cfg(feature = "application_root_profile")]
+pub fn run_with_profile(
+    tier: Tier,
+    seed: u64,
+    profile: warp_core::application_root::CommitmentProfile,
+) -> Observation {
+    run_from(
+        tier,
+        seed,
+        initial_state(tier).with_commitment_profile(profile),
+    )
+}
+
+fn run_from(tier: Tier, seed: u64, initial: WorldlineState) -> Observation {
     let script = script(tier, seed);
-    let initial = initial_state(tier);
     let base = initial.clone();
     let worldline_id = WorldlineId::from_bytes(WORLDLINE);
     let mut runtime = WorldlineRuntime::new();

crates/warp-core/src/application_root.rs

@@ -341,6 +341,51 @@ fn update(subtree: Option<&Arc<TrieNode>>, ops: &[(Key, Option<Hash>)]) -> Optio
     }
 }
 
+/// How a worldline's committed `state_root` is computed (M2, experimental).
+///
+/// The profile is part of a worldline's registration, like its initial state:
+/// it is chosen once, inherited by forks and replay bases, and never inferred
+/// from a root's bytes. A history is only verifiable under the profile it was
+/// committed with; replaying it under another fails with a root mismatch.
+#[cfg(feature = "application_root_profile")]
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+pub enum CommitmentProfile {
+    /// The legacy reachable-state root. Every existing history uses it, and
+    /// its recipe is unchanged.
+    #[default]
+    LegacyReachableV1,
+    /// The experimental application root: every record, reachable or not,
+    /// in the `echo.application-root.radix.v0` trie, tagged by
+    /// [`profile_tagged_state_root`] so it never equals a legacy root.
+    ApplicationRadixV0,
+}
+
+#[cfg(feature = "application_root_profile")]
+impl CommitmentProfile {
+    /// A stable identifier for diagnostics and descriptors.
+    #[must_use]
+    pub const fn id(self) -> &'static str {
+        match self {
+            Self::LegacyReachableV1 => "echo.state-root.legacy-reachable.v1",
+            Self::ApplicationRadixV0 => "echo.state-root.application-radix.v0",
+        }
+    }
+}
+
+/// The committed `state_root` of an application-profile worldline:
+/// `H("echo.state-root.application-radix.v0" || application_root)`.
+///
+/// The tag keeps the value domain-separated from every legacy root, so a
+/// root is never readable under the wrong profile.
+#[cfg(feature = "application_root_profile")]
+#[must_use]
+pub fn profile_tagged_state_root(application_root: &Hash) -> Hash {
+    hash_parts(&[
+        CommitmentProfile::ApplicationRadixV0.id().as_bytes(),
+        application_root,
+    ])
+}
+
 /// A persistent version of the application reading.
 #[derive(Clone, Debug, Default)]
 pub(crate) struct ApplicationTrie {

crates/warp-core/src/coordinator.rs

@@ -5917,12 +5917,15 @@ impl SchedulerCoordinator {
                                 &admitted_submission_ids(*key, &admitted),
                             )
                             .map_err(RuntimeError::from)?;
+                        // An application-profile commit already advanced the trie.
                         #[cfg(feature = "application_root_shadow")]
-                        frontier.state_mut().advance_application_root(
-                            application_root_was_current,
-                            outcome.patch.ops(),
-                            outcome.patch.out_slots(),
-                        );
+                        if !frontier.state().application_root_is_current() {
+                            frontier.state_mut().advance_application_root(
+                                application_root_was_current,
+                                outcome.patch.ops(),
+                                outcome.patch.out_slots(),
+                            );
+                        }
                         runtime_before
                             .state_journal_mut(key.worldline_id)?
                             .push_touches(touches);
@@ -5953,12 +5956,15 @@ impl SchedulerCoordinator {
                             &admitted_submission_ids(*key, &admitted),
                         )
                         .map_err(RuntimeError::from)?;
+                    // An application-profile commit already advanced the trie.
                     #[cfg(feature = "application_root_shadow")]
-                    frontier.state_mut().advance_application_root(
-                        application_root_was_current,
-                        outcome.patch.ops(),
-                        outcome.patch.out_slots(),
-                    );
+                    if !frontier.state().application_root_is_current() {
+                        frontier.state_mut().advance_application_root(
+                            application_root_was_current,
+                            outcome.patch.ops(),
+                            outcome.patch.out_slots(),
+                        );
+                    }
                     runtime_before
                         .state_journal_mut(key.worldline_id)?
                         .push_touches(touches);
@@ -8711,6 +8717,113 @@ mod tests {
         assert_eq!(provenance.len(worldline_id).unwrap(), 1);
     }
 
+    #[cfg(feature = "application_root_profile")]
+    #[test]
+    fn application_profile_commits_the_tagged_application_root_and_verifies_only_under_it() {
+        use crate::application_root::{profile_tagged_state_root, CommitmentProfile};
+
+        let worldline_id = wl(1);
+        let base =
+            WorldlineState::empty().with_commitment_profile(CommitmentProfile::ApplicationRadixV0);
+        let mut runtime = WorldlineRuntime::new();
+        let mut engine = empty_engine();
+        engine.register_rule(toy_increment_contract_rule()).unwrap();
+        runtime
+            .register_worldline(worldline_id, base.clone())
+            .unwrap();
+        register_head(
+            &mut runtime,
+            worldline_id,
+            "default",
+            None,
+            true,
+            InboxPolicy::AcceptAll,
+        );
+        let mut provenance = mirrored_provenance(&runtime);
+        assert_eq!(
+            provenance.initial_boundary_hash(worldline_id).unwrap(),
+            profile_tagged_state_root(&base.application_root()),
+            "the initial boundary is committed under the profile too"
+        );
+        for index in 0..4_u8 {
+            runtime
+                .ingest(IngressEnvelope::local_intent(
+                    IngressTarget::DefaultWriter { worldline_id },
+                    make_intent_kind("echo.intent/eint-v1"),
+                    toy_increment_intent(&[index]),
+                ))
+                .unwrap();
+            let records =
+                SchedulerCoordinator::super_tick(&mut runtime, &mut provenance, &mut engine)
+                    .unwrap();
+            let state = runtime.worldlines().get(&worldline_id).unwrap().state();
+            let tagged = profile_tagged_state_root(&state.application_root_rebuilt());
+            assert_eq!(records[0].state_root, tagged, "commit {index}");
+            assert_eq!(state.state_root(), tagged, "commit {index}");
+            assert_ne!(
+                tagged,
+                crate::snapshot::compute_state_root_for_warp_state(
+                    state.warp_state(),
+                    state.root()
+                ),
+                "the profile never reinterprets a legacy root"
+            );
+        }
+
+        let live = runtime.worldlines().get(&worldline_id).unwrap().state();
+        let replayed = provenance
+            .replay_worldline_state(worldline_id, &base)
+            .unwrap();
+        assert_eq!(replayed.state_root(), live.state_root());
+        assert_eq!(
+            replayed.commitment_profile(),
+            CommitmentProfile::ApplicationRadixV0
+        );
+        let legacy_base = base.with_commitment_profile(CommitmentProfile::LegacyReachableV1);
+        assert!(
+            matches!(
+                provenance.replay_worldline_state(worldline_id, &legacy_base),
+                Err(crate::provenance_store::ReplayError::InitialBoundaryHashMismatch { .. })
+            ),
+            "an application-profile history does not verify under the legacy profile"
+        );
+
+        let child_worldline_id = wl(43);
+        runtime
+            .fork_strand(
+                &mut provenance,
+                ForkStrandRequest {
+                    strand_id: make_strand_id("application-profile-fork"),
+                    source_lane_id: worldline_id,
+                    fork_tick: wt(3),
+                    child_worldline_id,
+                    writer_heads: vec![WriterHead::with_routing(
+                        WriterHeadKey {
+                            worldline_id: child_worldline_id,
+                            head_id: make_head_id("application-profile-child"),
+                        },
+                        PlaybackMode::Play,
+                        InboxPolicy::AcceptAll,
+                        None,
+                        true,
+                    )],
+                    retention_posture: test_retention_posture(10),
+                },
+            )
+            .unwrap();
+        let source = runtime.worldlines().get(&worldline_id).unwrap().state();
+        let child = runtime
+            .worldlines()
+            .get(&child_worldline_id)
+            .unwrap()
+            .state();
+        assert_eq!(
+            child.commitment_profile(),
+            CommitmentProfile::ApplicationRadixV0
+        );
+        assert_eq!(child.state_root(), source.state_root());
+    }
+
     #[cfg(feature = "application_root_shadow")]
     #[test]
     fn application_root_tracks_runtime_commits_forks_and_replay() {

crates/warp-core/src/echo_operation.rs

@@ -6458,7 +6458,7 @@ pub(crate) fn commit_scheduler_action_batch_to_state_v1(
     }
     debug_assert_eq!(
         state_root_before,
-        crate::snapshot::compute_state_root_for_warp_state(state.warp_state(), state.root()),
+        state.recomputed_state_root(),
         "the caller's state root must be the root of the state being committed"
     );
     let tx_raw = state