# View Contract trust provenance and controlled intensionality

## Problem

Tree Calculus / tricu code can perform raw intensional observation through `t` /
`triage`-like power. Exact detection of whether an arbitrary term ever reaches
rule 3 is undecidable: the SK fragment is already Turing-complete, and a program
can construct/apply an intensional observer iff an encoded machine halts.

Therefore View Contracts must not rely on an exact semantic test for "will this
term inspect representation?".

## Key correction

A purely syntactic invariant such as "the initial tree contains no
`Fork(Fork(_, _), _)`" is not reduction-closed. For example:

```text
Fork (Stem (Fork a b)) c  ==>  Fork (Fork a b) c
```

So absence of a current rule-3 redex is not enough.

## Direction

Use explicit provenance/capability discipline, not exact intensionality
decision.

View Contract checking and parametric checked-subset validation are distinct:

- View Contract checking: verifies executable tree artifacts against declared
  boundary Views.
- Parametric checked-subset validation: verifies that abstraction/parametricity
  claims do not depend on raw untrusted intensional observation.

Unchecked/raw Tree Calculus can always inspect trees. Existential/abstract Views
are checker-level opacity: checked clients cannot justify representation-specific
operations unless an exported trusted capability/eliminator provides them.

## Provenance model

Contract facts/artifacts should carry explicit provenance. Do not rely on module
or catalog convention.

Recommended durable provenance classes:

```text
Checked  -- derived by checked lowering / checker validation
Trusted  -- asserted by a trusted boundary, e.g. a primitive eliminator API
Unchecked -- no abstraction/parametricity guarantee; raw/assumed fact if exposed
```

The correct granularity is per exported View fact, not per module. A single
module may contain checked definitions, trusted eliminators, and unchecked raw
helpers.

## Controlled intensionality

Raw intensionality should be tracked by dependency/provenance, not syntax-only.

- Direct `triage` / arbitrary `t` eliminator use is raw intensional capability.
- Trusted eliminators expose controlled observation and do not taint clients.
- Calling unchecked/untrusted code taints the caller for parametricity purposes.
- Constructors/literals are not automatically tainting unless they expose raw
  inspection power.

Parametric checked mode rejects annotated definitions whose derivation depends
on raw/untrusted intensionality, while trusted facts may describe raw internals
behind explicit contracts.

## Trusted eliminator kernel

First trusted observation capabilities should be the smallest useful kernels:

```text
matchBool  : forall r. r -> r -> Bool -> r
matchMaybe : forall a r. r -> (a -> r) -> Maybe a -> r
matchList  : forall a r. r -> (a -> List a -> r) -> List a -> r
```

Derived functions should be checked against these trusted capabilities where
possible. Raw recursive kernels and other code
that passes through fixed-point/intensional machinery should publish explicit
`Trusted` facts rather than being treated as checked.

Current stdlib shape:

```text
Checked annotations where the body checks through trusted capabilities:
  maybeMap  : forall a b. (a -> b) -> Maybe a -> Maybe b
  maybeBind : forall a b. Maybe a -> (a -> Maybe b) -> Maybe b
  maybeOr   : forall a. a -> Maybe a -> a

Trusted value-level facts for raw/recursive stdlib boundaries:
  headMaybe / lastMaybe / nthMaybe
  append / map / filter / foldl / foldr
  length / reverse / snoc / count / all? / any? / intersect
  take / drop / splitAt / concatMap / find / partition / zipWith
  string/list-byte helpers such as strLength, startsWith?, lines, words
```

Do not assign total contracts to partial APIs such as:

```text
head : List a -> a
```

Prefer `headMaybe : List a -> Maybe a`, or later introduce `NonEmptyList a`.

## Implementation order

Most-correct tractable path:

1. Add contract provenance to the Haskell View model and portable artifacts. ✅
2. Preserve provenance through module exports/imports/re-exports. ✅
3. Teach checker environments to distinguish checked vs trusted facts. ✅
4. Add trusted stdlib eliminator facts. ◐ initial value-level `viewFacts` landed for `matchBool`, `matchMaybe`, `matchList`; Haskell trusted catalog removed
5. Add parametric-mode dependency/effect checking. ◐ local raw-dependency and unchecked-import rejection landed
6. Annotate/publish derived stdlib Views at the right provenance. ◐ checked `maybeMap`/`maybeBind`/`maybeOr`; trusted value-level facts for recursive list combinators

Avoid introducing implicit trusted catalogs before provenance exists; that would
create semantics that later need to be unwound.