Report conservative execution placement from checked dependency closures

test/emit-controllers.ts

@@ -61,7 +61,11 @@ const viewerPackage = viewer.resource.revision;
 viewerPackage.checkedQueries = await Promise.all(
   viewerPackage.queries!.map((query) => compileQuery(query, [iface], read)),
 );
-const preparation = presentationDeclarations(await read("quixos.react.json"), viewerPackage, environment.interfaceClosure);
+const preparation = presentationDeclarations(
+  await read("quixos.react.json"),
+  viewerPackage,
+  environment.interfaceClosure,
+);
 viewerPackage.buildArtifacts = { [preparationArtifact]: preparation.artifact };
 viewerPackage.queryCompositions = preparation.compositions.map((entry) =>
   compileQueryComposition(entry, new Map(viewerPackage.checkedQueries!.map((query) => [query.declaration.id, query]))),

test/fixtures/controller-device/quixos.react.json

@@ -1,7 +1,14 @@
 {
   "modules": {
     "Status": {
-      "inputs": [{ "name": "view", "query": "View", "root": { "from": "input", "path": ["subject"] }, "arguments": { "record": {} } }]
+      "inputs": [
+        {
+          "name": "view",
+          "query": "View",
+          "root": { "from": "input", "path": ["subject"] },
+          "arguments": { "record": {} }
+        }
+      ]
     }
   }
 }

test/placement.test.ts

@@ -0,0 +1,114 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { loadReaderWorkspace } from "./reader-fixture.js";
+import { buildArtifactFixture } from "./artifact-fixture.js";
+import {
+  compileExecutionPlan,
+  hexDigest,
+  inspectJavaScriptSurface,
+  reportExecutionPlacement,
+  type ExecutionInstallation,
+} from "../src/execution-world/index.js";
+
+test("compiled-source inspection finds authority imports and ambient facilities without executing code", () => {
+  const surface = inspectJavaScriptSurface(
+    `
+    import sdk from "/checked/core.mjs";
+    export * from "node:fs";
+    import path from "path";
+    import unknown from "./another.mjs";
+    const load = () => import(moduleName);
+    const req = () => require("node:net");
+    const n = Math.random(); const t = Date.now(); const next = new Date();
+    const call = () => fetch("https://example.test/");
+    const globalValue = globalThis["hidden"];
+    throw Error("INSPECTION_MUST_NOT_EXECUTE");
+  `,
+    ["/checked/core.mjs"],
+  );
+  assert.equal(
+    surface.some((f) => f.detail === "/checked/core.mjs"),
+    false,
+  );
+  for (const name of ["node:fs", "path", "node:net"])
+    assert.ok(surface.some((f) => f.code === "NATIVE_IMPORT" && f.detail === name));
+  for (const code of [
+    "UNCLASSIFIED_IMPORT",
+    "COMPUTED_MODULE_LOADING",
+    "AMBIENT_CLOCK",
+    "AMBIENT_RANDOMNESS",
+    "AMBIENT_HOST_ACCESS",
+  ])
+    assert.ok(
+      surface.some((f) => f.code === code),
+      code,
+    );
+  assert.ok(surface.some((f) => f.detail === "fetch"));
+  assert.ok(surface.some((f) => f.detail === "globalThis"));
+  assert.ok(surface.every((f) => typeof f.line === "number"));
+  assert.deepEqual(
+    inspectJavaScriptSurface(
+      'const d = new Date("2026-01-01"); const properties = { fetch: 1 }; properties.fetch; Math.floor(3.1);',
+    ),
+    [],
+  );
+  assert.equal(inspectJavaScriptSurface("const ???")[0]!.code, "UNCLASSIFIED_SYNTAX");
+  assert.equal(inspectJavaScriptSurface(" ".repeat(1024 * 1024 + 1))[0]!.code, "ANALYSIS_LIMIT");
+  const many = Array.from({ length: 100 }, (_, i) => `import x${i} from "unknown-${i}";`).join("\n");
+  const bounded = inspectJavaScriptSurface(many);
+  assert.equal(bounded.length, 64);
+  assert.equal(bounded.at(-1)!.code, "ANALYSIS_LIMIT");
+});
+
+const fixture = async () => {
+  const plan = compileExecutionPlan(await loadReaderWorkspace());
+  const artifacts = plan.definition.packages.map((pkg) => buildArtifactFixture(plan, pkg.revision));
+  const installation: ExecutionInstallation = {
+    codec: "camino-execution-installation-v1",
+    plan: plan.digest,
+    world: "a".repeat(64),
+    routes: {},
+    components: [],
+    packages: artifacts.map((f) => ({
+      revision: f.manifest.packageRevisionId,
+      root: "/fixture",
+      service: f.manifest.implementations[0]!,
+      module: f.manifest.implementations[1]!,
+    })),
+  };
+  return { plan, installation, read: artifacts[0]!.read };
+};
+
+test("placement separates native bindings, target portability, package eligibility and transitive blockers", async () => {
+  const { plan, installation, read } = await fixture();
+  const report = await reportExecutionPlacement(plan, installation, read);
+  const native = plan.definition.operations.find((op) => op.binding.kind === "state")!;
+  assert.equal(report.operations.find((op) => op.operation === native.key)!.requiresVM, false);
+  const consumer = plan.definition.operations.find(
+    (op) => op.binding.kind === "package" && op.dependencies.some((dep) => dep.kind === "operation"),
+  )!;
+  const before = structuredClone(consumer);
+  const entry = report.operations.find((op) => op.operation === consumer.key)!;
+  assert.equal(entry.requiresVM, true);
+  assert.deepEqual(entry.availableTargets, consumer.availableTargets);
+  assert.ok(entry.blockers.some((blocker) => blocker.code === "UNQUALIFIED_PACKAGE"));
+  assert.ok(entry.nativeBindings.includes("state"));
+  assert.ok(report.packages.every((pkg) => pkg.restrictedEligible === false));
+  assert.deepEqual(consumer, before, "Analysis cannot alter public contracts or placement");
+
+  // Add a dependency that disqualifies the consumer while preserving its interface.
+  const target = plan.definition.operations.find((op) => op.key !== consumer.key && op.binding.kind === "package")!;
+  consumer.dependencies.push({ kind: "operation", port: "unsafe-provider", operation: target.key });
+  target.execution = { kind: "remote" };
+  target.dependencies.push({ kind: "operation", port: "return-to-caller", operation: consumer.key });
+  plan.digest = hexDigest(plan.definition);
+  const after = await reportExecutionPlacement(plan, { ...installation, plan: plan.digest }, read);
+  const changed = after.operations.find((op) => op.operation === consumer.key)!;
+  assert.ok(
+    changed.blockers.some((blocker) => blocker.code === "REMOTE_EFFECT" && blocker.path.includes("unsafe-provider")),
+  );
+  assert.ok(changed.cycles.some((cycle) => cycle[0] === consumer.key && cycle.at(-1) === consumer.key));
+  assert.deepEqual(consumer.input, before.input);
+  assert.deepEqual(consumer.output, before.output);
+  await assert.rejects(reportExecutionPlacement(plan, installation, read), { code: "PLACEMENT_PLAN_MISMATCH" });
+});