Contracts

The DSL, the secret-blob format and pointer resolution keep their documented contracts.

38 checks in 3 files. Run: cd Typescript && npm run test:contracts. Source: Typescript/tests/

dsl.contract.test.mjs20 checks

Boot and get/set, hydrate, execute dispatch, mutation helpers, redacted public memories, snapshot import, selectors, [i] broadcast, filters, multi-select and range, projection, guest scope, explain() masking, tampered v2 and legacy secret blobs, bounded caches.

secret-blob-hardening.contract.test.mjs11 checks

Legacy and v2 snapshots still decrypt, a mixed public and secret snapshot rehydrates without leaking; tampered blobs, a wrong key, a wrong noise boundary and a blob copied to a sibling scope fail closed; replay keeps secret semantics.

pointer-category.contract.test.mjs7 checks

A 3-hop chain resolves, and so does one longer than the 8-hop budget; self-pointers, cycles of 2, 3, 5 and 7 nodes and a tail leading into a cycle fail closed without throwing.

run-contracts.mjs imports only these three files. The folder also holds keyspace, me-execute, wrapped-secret and wrapped-secret-negative contract files; npm test does not run them.

Last result: 38 passed. Run summary 2026-10-26