✓
Passing This code compiles and runs correctly.
Code
// Aspirational: compile-time taint tracking — the motivating use case for the
// ratified phantom cross-module design (OUTSTANDING_DESIGN_DECISIONS.md).
//
// A `taint` module declares a phantom-state VOCABULARY (the states ride on a
// builtin scalar []const u8, which has no home module of its own — so the state
// must name its own module rather than being implied by the type):
// <taint:tainted!> issued by any untrusted-input source
// <taint:sanitized!> issued by the sanitizer
// <taint:!sanitized> consumed by the query sink (the `taint` module's
// `sanitized` state, consume-marker on the state token)
// A downstream `query` event CONSUMES <app/lib/taint:!sanitized> on its input,
// so unsanitized data literally cannot reach the query — caught at compile time,
// zero runtime cost. The value is still just a []const u8 at runtime.
//
// This is the case that proves the design's shape: taint is a property of DATA
// (scalars/strings), not of any one type. A phantom state is a named,
// module-scoped, type-orthogonal dataflow property — general capability
// tracking (taint, authorization, provenance) with one mechanism.
//
// Resolution follows the MODULE SYSTEM (no virtual/synthetic namespaces): the
// `taint` qualifier resolves through the import map, and the borrowing module
// must import it.
//
// GREEN: the qualified taint states resolve cross-module through the import map
// and the full chain discharges — read-input issues <app/lib/taint:tainted!>,
// sanitize consumes <!tainted> and issues <sanitized!>, query consumes
// <app/lib/taint:!sanitized> — so the flow compiles and prints "ok". This test
// pins the taint use case and the ratified consume syntax (<module:!state>, `!`
// on the state token). See 330_087 for the cross-module qualified-consume
// resolution it rides on.
~import std/io
~import app/lib/taint
// Untrusted source: issues <app/lib/taint:tainted!>.
~tor read-input { } -> string<app/lib/taint:tainted!>
~proc read-input|zig {
return "untrusted";
}
// Sink CONSUMES the sanitized obligation: <app/lib/taint:!sanitized>. Unsanitized
// data can't land (it carries tainted!, not sanitized); and the obligation is
// discharged here so auto-discharge has nothing to complain about — isolating
// the cross-module-resolution gap as the sole RED reason.
~tor query { q: string<app/lib/taint:!sanitized> }
~proc query|zig {
return;
}
~read-input(): l |> app/lib/taint:sanitize(s: l): c |> query(q: c) |> std/io:print.ln("ok")
Actual
ok
Must succeed:
Compile and run without errors.
Expected output
ok
Flows
flow ~read-input click a branch to expand · @labels scroll to their anchor
read-input
Imported Files
// taint: a phantom-state VOCABULARY module (declares states, no types of its
// own). The states ride on builtin scalars (`[]const u8`), which have no home
// module — so the states must name their own module and be referenced qualified
// from any other module. This is the minimal compile-time taint tracker.
const std = @import("std");
// Issue a tainted obligation: the value is untrusted and must be sanitized.
~pub tor tag-tainted { payload: string } -> string<tainted!>
~proc tag-tainted|zig {
return payload;
}
// Consume <!tainted>, issue <sanitized!>: the value is now safe.
~pub tor sanitize { s: string<!tainted> } -> string<sanitized!>
~proc sanitize|zig {
return s;
}
Test Configuration
MUST_RUN