nx_abi_lock.nx

nx_abi_lock.nx -- sealed signature of a module's public ABI surface. LAYER 2 stability primitive paired with nx_module_cas. The IDE at nishifamily.com/ide pins each user program to BOTH the module CAS root (which proves bytes-equal) AND the upstream-substrate ABI lock (which proves "the public surface I depend on still exists and has the same shape"). An update that bumps internal bytes but doesn't alter the ABI returns NX_ABI_UNCHANGED -- safe to auto-rebind. A pure addition returns NX_ABI_ADDITIVE_OK. Anything else BREAKING_* and the IDE refuses to silently upgrade the user's pinned version. ABI signature shape (canonical bytes): for each public symbol, sorted by name lex-ascending: uvarint(name_len) || name_utf8 || uvarint(n_params) || uvarint(return_type_id) || for each param i in 0..n_params-1: uvarint(param_type_id_i) abi_signature = sha256(concat above) Type IDs are NishiLang TypeKind values (TY_VOID=0, TY_I64=4, etc. from ir.h). Substrate type-table is stable; type IDs do not change release to release. When adding a new TypeKind we add it at the end of the enum so old IDs stay valid -- cardinal global rule 19. Sealed verdict for ABI compat check (NX_ABI_*): 0 INCONCLUSIVE missing/empty symbol table on one side 1 BREAKING_REMOVED old symbol absent from new manifest 2 BREAKING_RETYPED same name but signature bytes differ 3 BREAKING_RESERIALIZED same name + arity but ret/param type id changed 4 ADDITIVE_OK every old symbol present, identical, plus new ones 5 UNCHANGED identical signature hashes both sides Cardinal global rule 19 (API Contract Stability) is enforced at the IDE bind point: the loader compares the user's pinned NX_ABI hash to the live substrate's hash. UNCHANGED or ADDITIVE_OK proceed silently; anything else paginates the user with a named diff and refuses to load until they re-pin. genealogy_id: semver_2_0_0 + abi_compat_lessons_glibc + rust_semver_trick +