feat(provider): judge authored effect programs in the lowerer and verifier

.ban-nondeterminism-allowlist

@@ -51,3 +51,4 @@ time-instant crates/warp-core/benches/support/fixtures/think_append.rs benchmark
 hand-hashed-table crates/warp-core/src/snapshot.rs state-root membership accelerator in private mod membership, whose only operations are begin and insert (no iterator, slice accessor or lookup, enforced by the compiler); exact key equality, no seed; its contents, capacity, probe counts, generation and fallback cannot affect the state root, which is independent of scratch history (tested against the ordered reference).
 
 std-fs crates/warp-core/tests/edict_effect_admission_tests/installation.rs owned filesystem WAL fixture directory creation and cleanup only; paths never enter program, policy, installation or receipt identities.
+std-fs crates/warp-core/tests/edict_effect_package_tests/provider_corpus.rs explicit ignored provider effect-corpus fixture regeneration only.

CHANGELOG.md

@@ -535,6 +535,19 @@
 
 ### Added
 
+- Echo's provider lowerer and verifier judge authored effect programs
+  themselves before publication and installation: artifact binding, adapter
+  authorization, each effect's intrinsic ABI and version-scoped failure
+  contract, declared obstructions, Core and Target IR correspondence, and
+  typing, proven ranges and budget under each component's own cost model.
+  `effect_publication::judge_effect_program` and
+  `encode_effect_publication` refuse unsafe programs with
+  `UnsupportedProgram`; `effect_package::verify_effect_package` also refuses a
+  package whose identities name another program. A retained corpus generated
+  by warp-core pins the verdict all three judgments reach.
+- The lowerer's and verifier's Core type readers accept an unsigned width named
+  directly in a type table (`{ kind: "U32" }`), as Core and the runtime do.
+
 - Runtime-owned installation retains exact policy and package evidence in the
   current WAL catalog and restores all program kinds through one fresh-host
   recovery path. Conflicts and failed WAL appends publish no registry entry.

crates/echo-edict-provider-lowerer/README.md

@@ -206,21 +206,30 @@ Those remain explicit Echo runtime crossings.
 ## Current effect proposal serialization
 
 The native Rust API `effect_publication::encode_effect_publication` serializes
-untrusted proposals using the current `echo.operation-package/v1` and
+proposals using the current `echo.operation-package/v1` and
 `echo.operation-program/v1` effect kind. It preserves the compiler bundle's
-exact bytes, derives embedded Core/Target-IR/exports identities, carries explicit
-limits and graph/footprint data, and requires a declared obstruction coordinate.
+exact bytes, derives embedded Core/Target-IR/exports identities, and carries
+explicit limits and graph/footprint data. The program's own exports declare
+every obstruction it can return.
 Its requested `authority_profile_identity` is derived only from the
 configuration's required `authorityProfile` label, by the same label digest
 fixed operations use; no caller supplies it.
 It uses the current `steps`, `read_bytes`, and `write_bytes` budget fields and
 retains the actual lawpack inside the compiled bundle, without a duplicate outer
 lawpack identity.
 
+Before serializing, publication runs the lowerer's own effect-program
+judgment, also available as `effect_publication::judge_effect_program`, and
+refuses an unsafe program with `UnsupportedProgram`. The judgment establishes
+the program's binding to its own artifacts, the pinned lawpack, adapter,
+profile and catalog that authorize each effect, each effect's intrinsic ABI and
+failure contract, declared obstructions, Core and Target IR correspondence, and
+the body's types, proven ranges and declared budget. It does not judge
+graph-law semantics or grant authority. The verifier judges the same programs
+independently in `effect_package::verify_effect_package`.
+
 The witness uses synthetic crate-local inputs and the current runtime decoder
 as a separate native test oracle. Kernel dependencies and their trusted-host
-features are dev dependencies only. The factory does not verify compiler
-correspondence, graph-law semantics or authority. It is not yet called by the
-public lowerer, and it does not change the frozen WIT interface or enable
-installed effect execution. Producer integration and independent verification
-remain unfinished.
+features are dev dependencies only. The public lowerer's component interface
+does not yet produce effect packages, and publication does not change the frozen
+WIT interface or enable installed effect execution.

crates/echo-edict-provider-lowerer/src/effect_publication.rs

@@ -26,6 +26,9 @@ pub enum EffectPublicationError {
     InvalidConfiguration,
     /// A required coordinate is missing or unbounded.
     InvalidCoordinate,
+    /// The compiled effect program is unsafe or does not match its own
+    /// artifacts, intrinsic contracts or declared budget.
+    UnsupportedProgram,
 }
 
 impl std::fmt::Display for EffectPublicationError {
@@ -34,11 +37,27 @@ impl std::fmt::Display for EffectPublicationError {
             Self::InvalidArtifact => "invalid effect publication artifact envelope",
             Self::InvalidConfiguration => "invalid effect publication configuration or limits",
             Self::InvalidCoordinate => "missing or unbounded effect publication coordinate",
+            Self::UnsupportedProgram => {
+                "the compiled effect program is outside the checked profile"
+            }
         })
     }
 }
 impl std::error::Error for EffectPublicationError {}
 
+/// Judges compiler-produced effect-program bytes without serializing them.
+///
+/// The lowerer establishes artifact binding, adapter authorization, each
+/// effect's intrinsic ABI and failure contract, Core/Target IR
+/// correspondence, typing, proven ranges and the declared budget itself.
+/// # Errors
+/// [`EffectPublicationError::UnsupportedProgram`] for any program outside
+/// that judgment.
+pub fn judge_effect_program(compiled_program: &[u8]) -> Result<(), EffectPublicationError> {
+    crate::executable_operation::effect_program::judge(compiled_program)
+        .map_err(|()| EffectPublicationError::UnsupportedProgram)
+}
+
 /// Serializes the single current operation-package and effect-program formats.
 ///
 /// This constructs an untrusted proposal. Callers must independently verify
@@ -190,6 +209,8 @@ pub fn encode_effect_publication(
     }
     let reads = number(field(budget, "readBytes", C)?)?;
     let writes = number(field(budget, "writeBytes", C)?)?;
+    // The program is judged only once its envelope and configuration are.
+    judge_effect_program(input.compiler_program)?;
     let mut footprint = blake3::Hasher::new();
     footprint.update(b"echo:operation-footprint-law:v1\0");
     footprint.update(law);

crates/echo-edict-provider-lowerer/src/executable_operation.rs

@@ -3,6 +3,7 @@
 //! Generic data-only lowering into Echo's bounded executable-operation profile.
 
 mod bounded_read;
+pub(crate) mod effect_program;
 mod effect_resources;
 mod source_functions;