# Stable Core Acceptance

> **Ownership:** compiler/CLI rows are proven by the standalone toolchain and
> consuming reference applications. This repository's local gate proves the
> public core library boundary.

This matrix records executable evidence for the developer-proof foundation. A
coverage-map label is not evidence by itself. Every core row below is exercised
by ordinary tests or a repository-owned CLI smoke path in `make verify`.

## Core matrix

| Area | Acceptance evidence | Result |
| --- | --- | --- |
| Generate | `compiler/generate` deterministic render and executable fixtures; `internal/genfs` ownership, no-op, stale removal, collision, symlink, manual-edit, check, and bounded diff tests; Commerce `generate --check` smoke | accepted |
| Verify and diagnostics | Loader, resolution, validation, exact provider, lifecycle, module, configuration, controller, bootstrap, and application-model failures; physical-order/source-map regression; shared `spice.diagnostics/v1` text/JSON tests and fuzz smoke | accepted |
| Build | Package-main generation/build fixture, `go build -trimpath`, generated-code compilation, offline vendor suite, and Windows plus Linux CLI compilation | accepted |
| Run | Real package-main generation/build/launch, application argument and exit-code preservation, temporary-candidate cleanup, legacy rejection, cancellation, Windows/Unix process-group adapters, and Commerce `spice run -- -check` smoke | accepted |
| Lifecycle | Dependency-order start, reverse stop/cleanup, construction and startup rollback, joined failures, cancellation, concurrent transitions, idempotent stop, fresh shutdown contexts, command timeout, and HTTP drain tests | accepted |
| Resources and conversion | Explicit immutable `fs.FS` mounts, canonical location/path rejection, bounded/canceled reads, typed codec composition, safe scalar failures, custom formatting, and shared configuration/HTTP scalar conversion | accepted |
| Expressions, interception, and bean composition | Restricted typed schema/parser/evaluator boundaries, compiler-rejected unsafe authorization expressions, generated executable request/response interceptor chains around direct/transaction/cache calls, nil/cancellation/order tests, and generated named override layers with deterministic child precedence and invalid/duplicate-name rejection | accepted |
| Validation | Layer-neutral typed validators, immutable violation ordering, cancellation, operational-failure short circuiting, bounded aggregation, and rejected-value-free errors | accepted |
| Modules | Compile-time root discovery, longest-root ownership, default/named API rules, allowed dependencies, internal-access rejection, cycles, unassigned packages, JSON/Mermaid/PlantUML rendering, and focused module tests | accepted |
| Configuration | Generated binders/metadata, defaults, profiles, JSON/environment precedence, provenance, validation, cancellation, secret redaction, management reporting, and raw-value leak regressions | accepted |
| Web | Generated strict body/path binding, validation, content negotiation, JSON/no-content responses, RFC 9457 mapping, middleware/observer ordering, panic handling, OpenAPI ownership, and graceful server drain | accepted |
| Security | Typed policy validation, generated deny-by-default route guards, exact role/scope decisions, safe 401/403 problems, bounded observations, and generated authorization execution | accepted |
| Data | Transaction commit/rollback/panic/cancellation, generated transactional routes, bounded repository cardinality and query secrecy, migration prefix/drift/failure behavior, SQL test slices, and opt-in PostgreSQL integration fixtures | accepted |

The mandatory repository path additionally runs formatting, module tidiness,
vendor reproduction, vet, allowlisted lint and NilAway, gosec, govulncheck,
shuffled and race suites, fuzz smoke, the 85% coverage floor, offline vendor
tests, module rendering/focus, generated freshness, and executable Commerce.

## Developer-proof integration

The final reference workflow now composes the accepted contracts:

- Commerce currently proves package-main discovery, exact generated DI,
  modules, typed configuration/redaction, lifecycle, generated HTTP/RFC 9457,
  management, metrics/logging, public cache-safe metadata, asynchronous work,
  scheduling, typed events, generated serializable transaction ownership,
  explicit repository interface injection, module-owned migration startup,
  and persisted retrieval.
- Order routes now exercise generated exact-scope security policies. The
  executable slice proves allowed decisions, safe unauthenticated 401
  responses, insufficient-scope 403 responses, and bounded authorization
  observations. Principal-specific order data is not placed in the shared
  cache; the compiler rejects that unsafe combination.
- Commerce uses a typed `storage.Orders` interface and generated direct
  binding to a reflection-free SQL repository. Its zero-dependency developer
  backend is an instance-owned transaction-aware `database/sql` connector, and
  its `integration`-tagged PostgreSQL path proves migration reconciliation,
  commit, pool close/reopen, and durable retrieval against the reviewed pgx
  starter.
- `notifications.Delivery` is an explicit concrete `mail.Sender` binding and
  `SystemClock` is an explicit clock binding. Commerce composes a deterministic
  typed MIME receipt with an attachment after transaction commit, delivers it
  through the bounded test transport in the default workflow, and can select
  the independently versioned
  [`starter-smtp`](https://github.com/spice-framework/starter-smtp) module
  through typed secret-redacted configuration. Tests inspect the decoded
  delivery and prove cancellation plus error sanitization.
- `spice dev`, the overlay compiler service, the editor-neutral LSP, the
  independently versioned primary GoLand integration, and the supported Zed
  integration are available. GoLand's exact prefix concealment, native token
  colors, PSI navigation, and light/Darcula visual reports are gated in
  [`spice-framework/goland`](https://github.com/spice-framework/goland),
  including proof that concealment preserves saved and copied valid Go. Raw annotation lines receive
  exact LSP diagnostics and a versioned comment-prefix repair instead of an
  opaque temporary-loader failure. Together with the commerce executable slice,
  these gates cover the decisive invalid-edit/fix/regenerate/restart/
  authorize/persist/deliver workflow without weakening valid Go source.
- The documented process workflow enables an explicit secret-redacted
  developer bearer token only on a loopback listener. It exercises the real
  `spice dev` process and generated guards without creating a default
  production backdoor; production authentication remains an OAuth2/OIDC
  integration concern.

## Reproduction

From the core repository root with Go 1.26.5, then from a checkout of the
independent [`commerce`](https://github.com/spice-framework/commerce) module:

```text
make verify
cd commerce
go tool github.com/spice-framework/toolchain/cmd/spice verify --format=json ./...
go tool github.com/spice-framework/toolchain/cmd/spice generate --check --target Commerce .
go tool github.com/spice-framework/toolchain/cmd/spice build --target Commerce .
go tool github.com/spice-framework/toolchain/cmd/spice run --target Commerce . -- -check
go tool github.com/spice-framework/toolchain/cmd/spice modules --format=json ./...
go tool github.com/spice-framework/toolchain/cmd/spice test --module github.com/spice-framework/commerce/orders --count=1 ./...
```