{"id":50718733,"url":"https://github.com/momentum-sez/op","last_synced_at":"2026-06-09T21:30:59.385Z","repository":{"id":352293762,"uuid":"1214575831","full_name":"momentum-sez/op","owner":"momentum-sez","description":"Op: typed bytecode for compliance-carrying operations in sovereign institutional kernels","archived":false,"fork":false,"pushed_at":"2026-04-18T21:51:46.000Z","size":325,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-18T22:16:47.348Z","etag":null,"topics":["bytecode","compliance","effect-systems","formal-methods","operational-semantics","programming-languages","rust","type-theory"],"latest_commit_sha":null,"homepage":"https://research.momentum.inc","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/momentum-sez.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-18T19:04:28.000Z","updated_at":"2026-04-18T21:51:51.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/momentum-sez/op","commit_stats":null,"previous_names":["momentum-sez/op"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/momentum-sez/op","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/momentum-sez%2Fop","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/momentum-sez%2Fop/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/momentum-sez%2Fop/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/momentum-sez%2Fop/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/momentum-sez","download_url":"https://codeload.github.com/momentum-sez/op/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/momentum-sez%2Fop/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34127342,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-09T02:00:06.510Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bytecode","compliance","effect-systems","formal-methods","operational-semantics","programming-languages","rust","type-theory"],"created_at":"2026-06-09T21:30:57.988Z","updated_at":"2026-06-09T21:30:59.377Z","avatar_url":"https://github.com/momentum-sez.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Op\n\n[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)\n[![CI](https://github.com/momentum-sez/op/actions/workflows/ci.yml/badge.svg)](https://github.com/momentum-sez/op/actions/workflows/ci.yml)\n[![Coq](https://github.com/momentum-sez/op/actions/workflows/coq.yml/badge.svg)](https://github.com/momentum-sez/op/actions/workflows/coq.yml)\n[![Release](https://img.shields.io/badge/release-0.1.0-orange.svg)](https://github.com/momentum-sez/op/releases)\n[![Rust](https://img.shields.io/badge/rust-1.86.0-brown.svg)](rust-toolchain.toml)\n\nOp is a typed, stack-based bytecode and deterministic operational semantics for\ncompliance-carrying operations in sovereign institutional kernels. An Op\nprogram is a directed acyclic graph of typed steps with an explicit effect\nrow, precondition and postcondition contracts, a scoped compensation branch\nattached to the step it inverts, and explicit suspension and resumption\nsemantics for callback events. Reduction is deterministic and metered by a\ntwo-axis gas model that separates structural cost from extensional cost, and\nevery execution produces a content-addressed proof bundle sufficient to replay\nthe operation on any host that shares the program definition, input bundle,\npack digest, oracle log, and deterministic primitive semantics.\nLex, the rule language for jurisdictional compliance, compiles into Op:\n`docs/language-spec.md` is the language surface, and the paper *Op: A Typed\nBytecode for Compliance-Carrying Operations* is the\nformal treatment.\n\n## What is new\n\nOp is the first typed bytecode in which the primitives of institutional\nworkflow are **language grammar**, not library idiom. Five features\ndistinguish it.\n\n1. **Effect rows with a sanctions-dominance law.** Tracked effects are\n   path-indexed; any reachable state mutation not dominated by a sanctions\n   check fails to type-check.\n\n2. **Typed suspension.** `await e within d` is a typed construct whose\n   continuation is serialized into the proof bundle, so suspension is as\n   replayable as computation.\n\n3. **Local compensation.** `compensate { … }` attaches syntactically to the\n   step it inverts; the rollback plan is derived by the compiler from the\n   forward DAG.\n\n4. **Linear and locked resources.** `Linear\u003cT\u003e` and the specified indexed\n   typestates `Locked\u003cT, omega, epsilon\u003e`, `Signed\u003cT, omega, epsilon\u003e`,\n   `Verified\u003comega, epsilon\u003e`, and `Blame\u003comega, epsilon, reason\u003e` lift\n   bilateral cross-zone commit obligations into the type surface. The current\n   Rust AST exposes the narrower unindexed `Locked\u003cT\u003e` prototype while the\n   indexed surface is closed formally.\n\n5. **Bilateral cross-zone composition.** Composition across two zones\n   produces verdicts via the pointwise meet on the compliance lattice. The\n   n-party MPST generalisation is a declared target, not a closed theorem in\n   this repository.\n\n**Prior art.** EVM (Wood, 2014) and WebAssembly (Haas et al., 2017) share\nthe typed-bytecode and determinism commitments but treat compliance effects,\nsuspension, and compensation as host concerns. Michelson (Allombert et al.,\n2018) shares the typed stack and formal semantics but is transaction-atomic\nand has no non-atomic suspension or cross-zone commit. Move (Blackshear et\nal., 2019) provides the linear-resource discipline Op specializes for\ncompliance-carrying workflows and extends with locked typestates for\ncross-zone commit resources. Op's contribution is the combination — typed\neffects with a sanctions-dominance law, typed suspension, local compensation,\nlinear and locked resources, and pairwise-replayable cross-zone execution —\nall as primitive grammar.\n\n## Why it matters\n\nA compliance workflow written in Op is a workflow whose execution trace is\nits audit and whose replay is its verification. The proof bundle is\nappend-only and content-addressed; a second zone re-runs the program against\nthe same inputs, pack digest, and oracle log and compares bundles\ndigest-by-digest.\n\nThe design target is five conservation invariants — gas conservation, resource\nlinearity, ownership conservation, audit monotonicity, and meet-monotonicity of\ncompliance state across zone composition. The repository contains scoped\nmachine-checked evidence for these claims over the fragments named below; full\nOp-proper progress, preservation, effect monotonicity, parallel confluence, and\nconcrete payload integration remain open.\n\nClasses of error that institutional workflows habitually tolerate — a\nskipped sanctions check, an unreversed registry filing, an uncoordinated\ncross-zone commit, an ambiguous writer on a state change — are not\nreachable because they are not expressible in the grammar.\n\n## Run it\n\n```bash\ncargo run --example hello-op -p op-core\n```\n\nOutput:\n\n```\nprogram      : hello.op  (jurisdiction: _default)\ntypecheck    : OK  (composed effects: [SovereignWrite, SanctionsCheck])\ngas bound    : 20 structural units\nstep gate      : screening.sanctions -\u003e COMPLETED\nstep activate  : update.entity_status -\u003e COMPLETED\nverdict      : ADMIT  (2 steps executed, trace is replayable)\n```\n\nThe example constructs a two-step program (a `sanctions_check`-dominated gate\nfollowed by a `sovereign_write` activation), type-checks it against the\neffect-row discipline, and dispatches both primitives through the built-in\n`NoopHost`. The source is `crates/op-core/examples/hello-op.rs`.\n\n## Reading path\n\nThe repository is organised in three layers; the boundary between them is\nload-bearing for every claim in the paper.\n\n**Executable — what the type checker accepts and what `cargo run` invokes.**\n\n- `docs/language-spec.md` — canonical language reference: grammar, type\n  system, effect system, contracts, compensation, multi-entity operations,\n  jurisdiction resolution, gas, policy blocks, EBNF.\n- `crates/op-core/` — language core: AST, type checker, effect-safety\n  analyser, gas model, evaluator, host trait.\n- `crates/op-compiler/`, `crates/op-stdlib/`, `crates/op-lex-compiler/` —\n  YAML lowering, canonical primitive corpus, Lex→Op compilation function.\n- `examples/incorporate.op`, `examples/letter-of-credit.op` — worked\n  programs over the canonical primitive corpus.\n\n**Mechanized evidence — scoped Qed results and disclosed boundaries.**\n\n- `formal/coq/` — Coq mechanisation: `OpCore.v` and `OpMetaTheory.v` for\n  the language; `BSCInvariants.v`, `BundleAppendOnly.v`,\n  `EffectRow.v`, `GasTermination.v`, `OpEffectMonotonicity.v`,\n  `OpProgressSubject.v` for conservation invariants;\n  `CompilationSoundness.v`, `LexOpAdequacy.v`, `LexVerdictEmbedding.v`,\n  `UpToTauCompatibility.v` for the Lex→Op verdict-preservation theorem over\n  the scalar admissible skeleton; `SessionCorridor.v`, `SessionDuality.v`,\n  `MPSTProjection.v`, `HeteroBisimulation.v` for the binary, payload-parametric\n  corridor skeleton; `WireFormatVerifier.v`, `CanonicalEncoding.v` for a small\n  canonical wire-format fragment. Several files intentionally use `Parameter`\n  or `Axiom`; `formal/coq/README.md` and the Op paper itemise them.\n- `formal/lean/OpCore.lean` — Lean mirror.\n\n**Frontier — milestones declared but not yet closed.**\n\n- `formal/coq/Op/` — F-OP-FORMAL milestone scaffolds (`Syntax.v`,\n  `Semantics.v`); typing relation, progress, preservation, and the\n  Lex→Op compiler-correctness theorem are queued for later milestones.\n\n**Paper.** *Op: A Typed Bytecode for Compliance-Carrying Operations* at\npaper — formal small-step operational semantics, scoped\nconservation evidence, Lex→Op verdict preservation for the admissible scalar\nskeleton, binary cross-zone replay and commit typing, prior-art placement, and\nopen problems.\n\n## Repository layout\n\n```text\nop/\n|-- crates/\n|   |-- op-core/           language, type checker, effect system, gas model, host trait\n|   |-- op-compiler/       YAML and source to Op bytecode lowering\n|   |-- op-stdlib/         canonical primitive corpus\n|   |-- op-lex-compiler/   Lex -\u003e Op compilation function (paper §6.2)\n|-- docs/\n|   |-- language-spec.md\n|-- examples/\n|   |-- incorporate.op\n|   |-- letter-of-credit.op\n|-- formal/\n|   |-- coq/               language, conservation invariants, Lex-\u003eOp soundness\n|   |-- lean/              OpCore.lean mirror\n|-- Cargo.toml\n|-- LICENSE\n|-- README.md\n```\n\nThe workspace compiles standalone from a cold clone; it has no path\ndependencies on external checkouts.\n\n```bash\ncargo check --workspace\ncargo test  --workspace\ncargo clippy --workspace -- -D warnings\n```\n\n## Relation to Lex\n\nLex is the rule and proof layer. Op is the workflow layer. Their interface is\npreconditions, postconditions, and effect discharge: a Lex predicate compiles\ninto an Op boolean expression, a Lex defeasible rule compiles into a guarded\n`choose`, and a Lex compliance-fiber verdict compiles into an Op\n`ensures domains` declaration. Op does not re-interpret Lex semantics at\nruntime; compilation is content-addressed and version-pinned at authoring\ntime. Lex lives at \u003chttps://github.com/momentum-sez/lex\u003e.\n\n## Reproducibility\n\nSee [`REPRODUCIBILITY.md`](REPRODUCIBILITY.md) for the exact toolchain pin,\nexpected test counts, example outputs, and hardware budgets. The repository\nships with a pinned Rust toolchain (`rust-toolchain.toml`), GitHub Actions\nCI for Rust and Rocq, and a self-contained workspace that compiles from a\ncold clone without sibling checkouts.\n\n## Contributing\n\nIssues and pull requests welcome. Before opening a pull request, run:\n\n```bash\ncargo test  --workspace\ncargo clippy --workspace -- -D warnings\n```\n\nNew primitives are added to `crates/op-stdlib` with a typed signature, a\ndefault effect row, and a lowering rule to a canonical host call; extensions\nto the language surface should cite the corresponding section of\n`docs/language-spec.md` or the paper and include tests in `crates/op-core`.\n\n## License\n\nApache-2.0. See [`LICENSE`](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmomentum-sez%2Fop","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmomentum-sez%2Fop","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmomentum-sez%2Fop/lists"}