Consolidate reviewed development engines and qualification boundaries

.github/workflows/linux.yml

@@ -40,6 +40,12 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
+      - name: Verify the checked-out container workspace
+        run: |
+          # The image user differs from the checkout owner. Trust this exact
+          # ephemeral workspace so Git identity and full-history checks run.
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
       - run: python3 -B Scripts/ci.py --lane '${{ matrix.lane }}'
       - name: Public composition and reference imports
         if: matrix.lane == 'linux'

AGENTS.md

@@ -1,22 +1,26 @@
 # Contributor instructions
 
-Development source is 1.7.0-dev; admitted N2 remains unreleased. The stable 1.6
-line has eight libraries and no JSONInspection. Preserve the branch-specific
-inventory and do not publish this development tree as a patch release.
+Development source is 1.7.0-dev. This consolidation retains the stable 1.6.1 line
+separately; it is not a maintenance release or the frozen 6fe8067 RC. Preserve
+all source-bound qualification history. Main integration never publishes a version.
 
 Swift-JSON requires Swift tools/compiler 6.4+, Swift language mode 6 and
 macOS/SDK 27+. Read README.md, CONTRIBUTING.md and the relevant contracts in
 Documentation/Architecture before changing behavior.
 
-- Keep ten public products in this source: JSON, JSONSchema, JSONSchemaExamples, JSONStreaming,
-  JSONPatch, JSONHTML, JSONBridges, JSONNavigation, JSONInspection and the swift-json executable.
+- Keep thirteen public products in this source: JSON, JSONSchema, JSONSchemaExamples,
+  JSONStreaming, JSONPatch, JSONHTML, JSONBridges, JSONNavigation, JSONInspection,
+  JSONTransform, JSONValueDSL, JSONSchemaDSL and the swift-json executable.
+  JSONDSLCore has public shared generic structure but no standalone product.
+  DSL staging/callbacks are trusted authored caller work; only finalization claims
+  a finite cumulative ledger. Core never imports or re-exports optional DSLs.
   JSONSchemaExamples is opt-in and depends on JSON and JSONSchema only.
   JSONFilterRuntime and JSONCLIEngine are package-private.
   JSONHTML and opt-in JSONBridges depend on JSON only; core never re-exports the bridges.
   The approved CLI and E2 additions preserve historical product contracts.
   JSONNavigation is a released opt-in product depending on JSON only; future merge/release remain human-gated.
   Published 1.6.1 has eight libraries plus CLI; this unreleased source includes
-  JSONInspection as the ninth library. Its API is separate from released Navigation.
+  JSONInspection plus the optional Transform and DSL products. Its API is separate from released Navigation.
   Future merge and release decisions remain human-gated.
   JSONInspection depends on JSON and JSONNavigation only; core re-exports neither.
   JSONRegexRuntime is package-private. Root package dependencies remain empty.
@@ -43,6 +47,15 @@ Documentation/Architecture before changing behavior.
 
 Scalar scanning and immutable plan-local regex sharing are selected private
 optimizations. Source-attached N3 snapshots and P1 tree/sparse-table projections live in JSONInspection.
-NAV10 exact structural-set/numeric-matrix views are public candidates in existing JSONInspection, not released.
-Graph/store engines, retrieval/persistence and JSON text-sequence framing remain deferred.
-The approved NAV10 promotion adds no product; future merge/release and wider APIs remain human-gated.
+NAV10 set/matrix and NAV11 directed-simple-graph APIs are development capabilities
+inside JSONInspection; no graph product, mutation or serializer is introduced.
+Private NAV12 store construction/preparation remains package-only and shares one
+original invocation ledger; no public store/follow API or persistence is exposed.
+Wider retrieval/persistence, NAV13 batches and JSON text-sequence framing remain
+separate, unadmitted work.
+
+JSONTransform uses one private compiler/VM and the CLI's accounted adapter.
+Preserve its accepted 42 authored declarations and exact semantics. The original
+1.7.0 P4 waiver and later partial measurements are historical scoped evidence;
+no allocation, speed, RSS or controlled-performance pass follows from consolidation.
+See Documentation/Qualification/Consolidation2026.md for combined gates and holds.

CHANGELOG.md

@@ -1,6 +1,43 @@
 # Changelog
 
-## 1.7.0 — Unreleased
+## Unreleased — 1.7.0-dev consolidation
+
+- Reconcile admitted set/matrix APIs with the reviewed public directed graph,
+  shared JSONTransform compiler/pull VM and optional exact value/schema DSLs.
+- Retain package-only configured-store preparation/construction with one original
+  scope/ledger; no public store, follow or persistence API is introduced.
+- Keep twelve libraries plus CLI and thirteen DocC catalogs including the shared
+  JSONDSLCore reference. Root dependencies and Apple deployment floors remain unchanged.
+- Preserve finite exact semantics and all predecessor fixtures, failures and
+  performance/platform holds. Require fresh combined-source qualification; a merge
+  is development integration and does not publish a version.
+- See [combined qualification](Documentation/Qualification/Consolidation2026.md).
+
+### Historical JTX10 release-candidate checkpoint (unpublished)
+
+
+- Add opt-in JSONTransform over the existing shared compiler and pull VM; retain
+  immutable Sendable plans, guarded invocation-owned execution, exact native output
+  admission and package-only cumulative CLI adapters. No second interpreter.
+- Include admitted Inspection array evidence, source-attached snapshots, trees and
+  sparse tables: ten libraries plus CLI, ten catalogs, 1,214 authored declarations.
+- Report candidate source version 1.7.0 with deterministic CLI identity; stable
+  remains 1.6.1. Publication and exact-version consumption are separate later gates.
+- Preserve loaded-host timing limits, original 8M refusal and separately approved
+  private 100k16M profile. Record the explicit one-time allocation-instrumentation
+  waiver; events, allocated bytes and profiler overhead remain unknown.
+- See [candidate qualification](Documentation/Qualification/Release1.7.0.md) for
+  source-bound gates, Apple/Linux/scoped WASI claims and historical holds.
+
+### Historical JSONTransform extraction checkpoints
+
+- Add an optional public compiler/pull API over the single existing private query kernel.
+- Preserve CLI ownership through package-only cumulative adapters; add real-engine
+  lifecycle, exactness, provider and typed failure tests and a standalone consumer.
+- Retain rejected inout substitution and Swift 6.4 borrowed-capture compiler failure
+  evidence; the guarded handle API and release qualification remain provisional.
+
+### Earlier 1.7 development metadata checkpoint (historical)
 
 - Retain admitted opt-in JSONInspection: observation-only array evidence, exact
   first-seen columns and explicit complete/prefix coverage; 44 authored
@@ -76,6 +113,11 @@
 The protected public version tag exists; its separate GitHub release remains draft.
 These additive APIs are also included in the published 1.5.0 release.
 
+- Add opt-in JSONValueDSL and JSONSchemaDSL products for typed, trusted authored
+  values and Draft 2020-12 declarations. Exact values and schema semantics remain
+  owned by the existing engine. Finalization uses one finite iterative ledger;
+  authored staging and callbacks are explicitly outside its resource accounting.
+
 - Add E2's shallow JSON parsing, checked object construction, decimal-text and
   pre-parsed Pointer entry points; exact-key membership and three-state presence
   composition; and direct validation from an immutable compiled schema plan.

CONTRIBUTING.md

@@ -1,7 +1,8 @@
 # Contributing
 
 Choose the source line deliberately: maintenance changes use the 1.6 line;
-new capabilities target unreleased 1.7.0-dev. Keep the lines' API inventories
+new capabilities target development. This checkout is unreleased 1.7.0-dev consolidation source; preserve the reviewed
+component APIs/algorithms and qualify every combined source. Keep the lines' API inventories
 separate and map applicable maintenance corrections forward by content/commit,
 without assuming a squashed maintenance tip is an ancestor of main. See the
 [release-line matrix](Documentation/Qualification/ReleaseLines.md).

Documentation/Architecture/API.md

@@ -1,28 +1,51 @@
+# Current API inventory
+
+Unreleased 1.7.0-dev consolidation has twelve library products plus swift-json and
+thirteen DocC catalogs including the non-product JSONDSLCore reference. The native
+compiler graphs define the complete authored inventory. JSONTransform and the
+trusted-authored DSLs are opt-in; the core products retain their semantic authority.
+The stable 1.6 inventory and chronological component records below retain their
+original scope, not the current combined product count. See
+[combined qualification](../Qualification/Consolidation2026.md).
+
 # Public API contract
 
-This document describes the implemented public interface. Native compiler symbol
-graphs supply the complete declarations in the eight DocC catalogs. Examples
-in the [README](../../README.md) are compiled and executed by the public consumer.
+The current product table below describes this development source. Stable 1.6.1
+retains eight libraries plus CLI and eight catalogs. Development adds Inspection,
+Transform and both optional authored DSL products, with a shared JSONDSLCore
+reference catalog. Existing released contracts remain unchanged. Compiler symbol
+graphs supply the complete authored declarations; the README examples are compiled
+and executed by public consumers.
 
 ## Products and ownership
 
 | Product | Main entry points | Owned implementation boundary |
 | --- | --- | --- |
 | JSON | JSON, JSONNumber, JSONObject, JSONParser, JSONWriter, JSONValueEncoder, JSONValueDecoder, JSONPointer, JSONDocument | Shared strict codec, exact decimal model, bounded traversal and native coding |
 | JSONNavigation | JSONTraversal, JSONTraversalScope, JSONTraversalOptions | Exact many-node DFS, strict physical/virtual scopes, bounded metadata and explicit coverage; one core read-scope meter |
+| JSONInspection | JSONShapeInspector, JSONStructuralSnapshot, JSONGraphProjection | Source-attached observed evidence, immutable exact projections, set/matrix and directed graph views; finite invocation-owned reads |
+| JSONTransform | JSONTransformProgram, JSONTransformOutput, JSONTransformExecution | Shared query compiler/pull VM, exact native values, finite guarded execution and typed terminal errors |
+| JSONValueDSL | JSONValueDSL.object/array, Field, Element, Elements | Trusted authored staging; finite iterative exact finalization |
+| JSONSchemaDSL | JSONSchemaDSL.document/boolean, Schema, Property, Definition, PatternProperty, DependentSchema, RequiredDependency, Rule | Trusted authored schema declarations; existing document/compiler/validator authority |
 | JSONBridges | BinaryInteger.jsonNumber, FixedWidthInteger/Double/Decimal.init(jsonNumber:), Double.jsonNumberFromRoundTripText | Optional one-delegate numeric conversions; explicit fidelity, no new authority |
 | JSONSchema | JSONSchemaDocument, JSONSchemaRegistry, JSONSchemaCompiler, CompiledJSONSchema, JSONSchemaValidator | Offline immutable plan, invocation-owned evaluation and private native regex |
+| JSONSchemaExamples | JSONSchemaExampleGenerator, JSONSchemaExampleResult | Conservative deterministic witnesses certified by the existing native validator; separate finite preparation and cumulative generation |
 | JSONStreaming | JSONEventSequence, JSONValueSequence, NDJSONValueSequence, JSONTopLevelArraySequence, JSONAsyncWriter | Exclusive pull state, shared codec, strict framing and awaited handoffs |
 | JSONPatch | JSONPatch, JSONPatchOperation, JSONPatchResult, JSONMergePatch | Transaction staging, exact comparison and iterative editing |
-| swift-json | format, validate, pointer, patch, query, stream, schema, render | Bounded process/file adapters and private CLI engine/filter runtime; no public query library |
+| swift-json | format, validate, pointer, patch, query, stream, schema, render | Bounded process/file adapters; the public Transform facade and CLI use the same private query compiler/VM |
 | JSONHTML | JSONHTMLRenderer, JSONHTMLRenderingOptions, JSONHTMLLimits, JSONHTMLRenderReport, JSONHTMLAnnotation, JSONExportDocument, JSONExportOptions, JSONExportReport | Structured forms/cards and bounded native previews, exact HTML, native Apple transfer, immutable prepared JSON/text/Markdown/static HTML/opt-in styled RTF and cumulative budgets |
 
 JSON imports no siblings. JSONSchema depends on JSON and package-private
 JSONRegexRuntime. Streaming, Patch, HTML, Bridges and Navigation depend on JSON.
-JSONSchemaExamples depends only on JSON and JSONSchema. There are nine public products: eight libraries and the swift-json executable,
-and no external root-package dependencies. No HTTP, MCP or documentation-tool dependency is introduced. JSONHTML conditionally
-uses Apple SDK frameworks for explicit native transfer/PDF preparation; the portable
-value, schema, Patch and streaming contracts do not acquire UI semantics.
+JSONSchemaExamples depends only on JSON and JSONSchema. JSONInspection depends on
+JSON and JSONNavigation. JSONTransform depends on JSON and the package-private
+JSONFilterRuntime; JSONCLIEngine uses the same engine. Optional DSL products depend
+on JSON/JSONSchema and JSONDSLCore as declared in Package.swift. There are twelve
+library products plus swift-json and no external root-package dependencies. The
+shared helper has no standalone library product. JSONHTML conditionally uses Apple
+SDK frameworks for explicit native transfer/PDF preparation; core value, schema,
+Patch and streaming semantics remain portable. Package-only store preparation is
+not a public API or a second ledger. No online resolver or runtime dependency is added.
 
 Immutable facades store value configuration. Every operation owns its mutable
 context; every stream iterator requires exclusive access. Sendable follows the
@@ -288,3 +311,74 @@ the generated identity file itself. It is not a Git commit, binary digest or cla
 of publication. Generation/checking needs no Git, time, environment or network.
 
 JSONNavigation product promotion preserves all 56 N1 public declarations and resource semantics. Full-source admission precedes invalid depth/record-option validation, including oversized sources; N1Promotion.md records this preserved precedence. JSON imports no Navigation symbols implicitly.
+
+## Provisional JSONTransform extraction (1.7 feature branch)
+
+JSONTransform is an opt-in public product depending on JSON and the private
+JSONFilterRuntime kernel. JSON and JSONSchema do not import or re-export it.
+JSONCLIEngine uses its package-only accounted adapters; both callers execute the
+same FilterCompiler/FilterVM. The public interface contains no CLI context, file,
+process, exit-code or private-runtime signature.
+
+- `JSONTransformProgram.compile(_:variables:limits:)` creates an immutable Sendable
+  plan under finite compilation limits. Variable names are ASCII identifiers,
+  without `$`; JSON values retain exact native number and scalar-key semantics.
+- `withExecution(input:bindings:limits:source:_:)` creates a synchronous guarded
+  invocation and returns `JSONOperationReport<Result>`. Root admission, bindings,
+  all pulls/provider values and output results share one cumulative ledger.
+- `JSONTransformExecution.next()` returns `JSONTransformOutput?`. Nil means EOF;
+  a present handle may contain JSON null. Handles share one owner and are not
+  Sendable. Scope exit invalidates data access and releases provider/frame/root
+  ownership; output aliases retain their source reservation until last release.
+- `statistics`, `used(_:)` and `remainingWorkUnits` expose finite accounting without
+  exporting a mutable meter. During provider callbacks they report the bounded
+  callback-entry snapshot. `cancel()` latches terminal cancellation.
+- `JSONTransformLimits` combines the existing native policy with eleven mapped
+  transform ceilings. `JSONTransformFailure` distinguishes compilation, language,
+  resource, cancelled, provider and configuration failures. Owned operational
+  failures bypass query catches and remain terminal after caller catches.
+
+Provider work/allocations and extracted JSON copies belong to the caller; logical
+retention does not cap process RSS. Re-entering next() from the same provider
+throws `configuration/reentrantExecution` before accessing its borrowed context.
+The CLI retains one ledger across parsing, transformation, writing and diagnostics,
+its sixteen existing metric names and its own completion/EOF duties. Public
+compilation and execution are separate finite scopes, not one combined claim.
+
+See the [actual API/ownership decision](Release1.7/JSONTransform.md),
+[DocC guide](../../Sources/JSONTransform/Documentation.docc/ScopedTransforms.md)
+and [standalone public SwiftPM consumer](../../Tools/TransformQualification).
+This is an unreleased candidate, absent from published 1.6.1. No merge, tag,
+publication, new dialect, implicit floating bridge or feature from another draft
+follows from this contract.
+
+## 1.7.0 release-candidate authority
+
+This unpublished candidate retains the accepted Transform API (42 authored
+declarations) and Inspection API (95), with all 56 Navigation declarations
+unchanged. Historical provisional headings above remain stable link targets and
+checkpoint descriptions; the [candidate contract](../Qualification/Release1.7.0.md)
+and final compiler graphs determine current scope. API shape acceptance does not
+imply publication, measured allocations or unobserved platform execution.
+
+## Optional Dual DSL P1.2
+
+The two DSL products do not change or re-export the existing core entry points.
+JSONDSLCore has no standalone product; its public structural builder types occur
+in the optional generic signatures. See the [decisions](DualDSL/Decisions.md).
+Callbacks, content emission and staging are trusted and unmetered. Finalization
+uses one finite invocation ledger through iterative construction and, for schemas,
+document admission. This does not imply whole-pipeline cumulative billing, staging
+retention, caller instruction or RSS bounds. No whole-DSL report is supplied.
+
+Exact duplicate names throw JSONFailure/duplicateKey. Decoded scalar identity and
+order are preserved. Missing declarations emit nothing; null, empty containers and
+Boolean schemas differ. Array flattening requires Elements(contentsOf:). Implicit
+numbers accept BinaryInteger only, with explicit JSONNumber for decimals. E2 and
+JSONBridges remain unchanged; DSL targets import neither bridge nor framework DSL.
+
+Schema rawKeyword preserves declarations for existing compiler classification.
+No requiredness/default/format/reference/annotation policy is inferred. Invalid
+instances return false; malformed schemas, offline missing resources, nonproductive
+cycles, resource failures and cancellation remain operational errors. Factories
+never validate or publish a candidate schema as already compiled.