v2026.6.26: SPEC-245 Phase 6 — ReinterpretCap + Layer B Authority

v2026.6.26: SPEC-245 Phase 6 — ReinterpretCap + Layer B Authority

std.mem.zerocopy now ships the Layer B authority token: a manifest-bound capability that gates byte→struct reinterpretation behind a hinge.kdl declaration. Combined with the Layer A type-soundness traits (shipped in Phase 2), a Janus binary can reinterpret untrusted bytes as a typed struct only when:

1. The struct’s layout is type-sound (no padding, all fields valid for every bit pattern — FromBytes + Unaligned).
2. The bytes are authorized to be reinterpreted as that struct (the manifest declares a ReinterpretCap[T] for that type from that source class).
3. The runtime check at the call site confirms both (Phase 6.3 ships authorized_ref_from_bytes[T]).

This release lands the first two layers fully; Layer 3 is in Phase 6.3 (blocks on Phase 4 compiler derive mechanism).

What shipped

std.mem.zerocopy.cap — ReinterpretCap[T] authority token

The .reinterpret capability class (added by SPEC-091-Amendment-A, ratified 2026-06-25) gates byte→struct reinterpretation at the manifest boundary. The token is generic in T (the destination type) and carries:

• schema_fingerprint_lo/hi — half of §sbi_fingerprint(T) (the SBI canonical type hash, per SPEC-039 §1.3).
• allowed_sources_mask — bitmask over the Phase 7 source-class lattice (Network / Disk / SharedMem / Pipe / Trusted).
• issued_at — wall-clock provenance timestamp.
• issuer — std.crypto.Identity placeholder (u64 for v1).
• capabilities_mask — CAP_READ | CAP_WRITE bitmask (Layer A per-mask discipline: which reinterpret directions this cap permits).

Construction is restricted to the runtime, an authority-narrowing helper (cap_narrow[T]), or a :sovereign-privileged issuer. User code cannot construct caps directly — the compiler rejects with E2601 (E_ZC_CAP_CONSTRUCTION_FORBIDDEN).

std.mem.zerocopy.provenance — source-class lattice

The Phase 7 source-class lattice from std.runtime.manifest is now exposed in std.mem.zerocopy.provenance for Layer B consumers. The SourceClass enum has five core variants (Network / Disk / SharedMem / Pipe / Trusted), with a SourceSet bitset for the allowed_sources field of ReinterpretCap[T]. Extension source classes (ext::<name>) land with the Phase 7 follow-up extension registry.

std.mem.zerocopy.eql_ct — constant-time byte equality

The constant-time byte-equality primitive is the canonical primitive for crypto tag comparison, signature digest comparison, password hash comparison, and anywhere timing leakage would permit forgery. Sibling to std.mem.raw.eql (Axis 4 of the four-axis equality model per SPEC-equality-model §3). Gated under :sovereign because raw pointer arithmetic is required.

SPEC-091-Amendment-A (doctrinal ratification)

The .reinterpret capability class was added to SPEC-091’s Capability Class Universe via a formal amendment. The amendment:

• Adds .reinterpret row to §2.2 Capability Class Universe.
• Establishes .typed scope universe in §2.3.
• Adds §2.4 Generic Capability Support (formalized [CAP:2.4.1]-[CAP:2.4.4]).
• Documents :sovereign-only profile gating (§A.4).
• Adds cap_narrow[T] authority-narrowing helper (§A.5).
• Documents cross-binary cap transfer protocol (Q3 lock, §A.6).

BDD scenarios (Phase 6.5)

Three of ten BDD scenarios ship today:

Scenario	Status
cap_from_manifest[T] field round-trip	✅ SHIPPED
cap_narrow[T] monotonic narrowing	✅ SHIPPED
Q1 lifetime guarantee (cap stays valid across calls)	✅ SHIPPED
Manifest materialization at program entry	DEFERRED — runtime integration
E_ZC_CAP_CONSTRUCTION_FORBIDDEN enforcement	DEFERRED — Sema E2601 for .reinterpret
cap_from_manifest fingerprint mismatch	DEFERRED — Phase 6.3 (Phase 4 derive)
authorized_ref_from_bytes source rejection	DEFERRED — Phase 6.3 (Phase 4 derive)
view cap parameter cannot be narrowed by callee	DEFERRED — SPEC-085 Sema
Manifest fingerprint mismatch → program-entry error	DEFERRED — runtime + §sbi_fingerprint
Missing manifest declaration → link/load error	DEFERRED — runtime link-time check

The seven deferred scenarios are documented at janus-lang/tests/spec_245/phase6/cap_245_deferred_scenarios.jan with their specific blockers.

Compiler improvements

• COMPILER-GAP-098 closed (struct-with-array return value corruption). The emitReturn ZST early-return was firing for sret-classified functions (which have LLVM-level void return signature), bypassing the sret-copy path and leaving the caller’s destination slot uninitialized. Fix: check the sret registry BEFORE the ZST check. Side effects: std.runtime.manifest.parse_capabilities_block works for the first time; cap.jan fields can move from u32 placeholders to production u64/u128/u256 widths.

Test surface

zig build test-zerocopy-cap-smoke          # Phase 6.1+6.2 ✅
zig build test-manifest-zerocopy-smoke     # Phase 6.4 ✅
zig build test-phase-6-5                   # Phase 6.5 BDD ✅
zig build test-gap098-regression           # GAP-098 regression test ✅
zig build test-manifest-orig-smoke        # SPEC-091 §6 (now passing) ✅

No regressions across the full zerocopy + SPEC-091 + manifest test surface (16 tests pass, 0 failures).

What’s next

• Phase 6.3 — authorized_ref_from_bytes[T] (the Layer B runtime check). Blocks on Phase 4 (compiler derive mechanism — Virgil lane).
• SPEC-039 fingerprint migration — cap.jan fields can move from u32 placeholders to production u128/u256 widths now that COMPILER-GAP-098 is fixed.
• Phase 7 extension registry — ext::<name> source classes for vendor-specific sources (GPU memory, sensor DMA, hardware attestation). Separate from Phase 6.5/6.6.

Doctrinal anchors

• SPEC-245-std-mem-zerocopy.md — full normative specification
• SPEC-091-Amendment-A-reinterpret-capability.md — capability universe extension
• SPEC-equality-model.md — four-axis equality (Axis 4 = eql_ct)
• Janus/.agents/doctrines/zerocopy-model.md — design rationale and prior-art comparison (Rust zerocopy, Cap’n Proto, OpenBSD pledge)