Migrated from Method backlog
This issue was created from a legacy filesystem backlog card. GitHub Issues are now the live work tracker; repository docs remain Method evidence.
Source backlog: docs/method/backlog/inbox/KERNEL_deterministic-rhai.md
Original lane: inbox
Original legend: KERNEL
Original backlog card
Deterministic Rhai
Milestone: Backlog | Priority: Unscheduled
A sandboxed Rhai scripting surface for simulations where all host access (time, IO, randomness) goes through explicit View/Claim/Effect channels, preserving Echo's determinism guarantees.
Issue: #173
T-10-6-1a: Rhai Sandbox Configuration (#173, part a)
User Story: As a simulation author, I want a Rhai sandbox that disallows non-deterministic operations so that scripts cannot accidentally break replay determinism.
Requirements:
- R1: Configure Rhai
Engine with no file IO, no system time, no random
- R2: Disable all Rhai packages that expose non-deterministic APIs
- R3: Expose a
DeterministicEngine::new() constructor that returns a locked-down engine
- R4: Compile-time (script parse) rejection of forbidden identifiers if feasible
- R5: Runtime trap if a forbidden operation is somehow reached
Acceptance Criteria:
Definition of Done:
Scope: Rhai engine configuration, forbidden API enforcement.
Out of Scope: ViewClaim/EffectClaim system, fiber model, script-to-WASM compilation.
Test Plan:
- Goldens: Script output for a deterministic test script (bit-exact across runs)
- Failures: Script using
timestamp(), script using file IO, script using rand()
- Edges: Script that defines a function named
timestamp (user-defined, should be allowed)
- Fuzz/Stress: Run same script 1000 times, assert identical output
Blocked By: none
Blocking: T-10-6-1b
Est. Hours: 5h
Expected Complexity: ~300 LoC
T-10-6-1b: ViewClaim / EffectClaim Receipts (#173, part b)
User Story: As the Echo runtime, I want Rhai scripts to declare their state reads and writes via ViewClaim and EffectClaim receipts so that the scheduler can track data dependencies and verify determinism.
Requirements:
- R1: Define
ViewClaim type (declares what state a script intends to read)
- R2: Define
EffectClaim type (declares what state a script intends to write)
- R3: Register both types as custom Rhai types accessible from scripts
- R4: Script execution returns a
Receipt containing all claims made
- R5: Claims are validated against actual reads/writes — mismatch is an error
Acceptance Criteria:
Definition of Done:
Scope: Claim types, receipt collection, claim validation.
Out of Scope: Fiber/coroutine model, claim-based scheduling optimization, persisted receipts.
Test Plan:
- Goldens: Receipt contents for a known script with known claims
- Failures: Missing ViewClaim, missing EffectClaim, claim for nonexistent state
- Edges: Script with zero claims (pure computation), script claiming everything
- Fuzz/Stress: n/a
Blocked By: T-10-6-1a
Blocking: none
Est. Hours: 6h
Expected Complexity: ~400 LoC
Migrated from Method backlog
This issue was created from a legacy filesystem backlog card. GitHub Issues are now the live work tracker; repository docs remain Method evidence.
Source backlog:
docs/method/backlog/inbox/KERNEL_deterministic-rhai.mdOriginal lane:
inboxOriginal legend:
KERNELOriginal backlog card
Deterministic Rhai
A sandboxed Rhai scripting surface for simulations where all host access (time, IO, randomness) goes through explicit View/Claim/Effect channels, preserving Echo's determinism guarantees.
Issue: #173
T-10-6-1a: Rhai Sandbox Configuration (#173, part a)
User Story: As a simulation author, I want a Rhai sandbox that disallows non-deterministic operations so that scripts cannot accidentally break replay determinism.
Requirements:
Enginewith no file IO, no system time, no randomDeterministicEngine::new()constructor that returns a locked-down engineAcceptance Criteria:
DeterministicEngine::new()returns an engine that rejectstimestamp(),rand(), file opsDefinition of Done:
Scope: Rhai engine configuration, forbidden API enforcement.
Out of Scope: ViewClaim/EffectClaim system, fiber model, script-to-WASM compilation.
Test Plan:
timestamp(), script using file IO, script usingrand()timestamp(user-defined, should be allowed)Blocked By: none
Blocking: T-10-6-1b
Est. Hours: 5h
Expected Complexity: ~300 LoC
T-10-6-1b: ViewClaim / EffectClaim Receipts (#173, part b)
User Story: As the Echo runtime, I want Rhai scripts to declare their state reads and writes via ViewClaim and EffectClaim receipts so that the scheduler can track data dependencies and verify determinism.
Requirements:
ViewClaimtype (declares what state a script intends to read)EffectClaimtype (declares what state a script intends to write)Receiptcontaining all claims madeAcceptance Criteria:
ViewClaimandEffectClaimvaluesReceiptis returned after script execution with all claimsViewClaimproduces an errorEffectClaimproduces an errorDefinition of Done:
Scope: Claim types, receipt collection, claim validation.
Out of Scope: Fiber/coroutine model, claim-based scheduling optimization, persisted receipts.
Test Plan:
Blocked By: T-10-6-1a
Blocking: none
Est. Hours: 6h
Expected Complexity: ~400 LoC