Make the published Soufflé program idiomatic

[afogel]

Stacked on #46 (V8). Follow-up to the review of ir/dist/rules.dl: the compiled program now reads as a Soufflé author would write it, and the compiler checks what Soufflé checks.

What changed

• Column domains as subtypes. Every vocabulary column has a domain, defaulting to its name; a column holding the same kind of value under another name declares it (request_seq is a seq, parent is a pid). The emitter declares each domain as .type Seq <: number and types every relation with them. The compiler refuses a rule that joins or compares two domains, so a rule that Soufflé would reject never reaches the .dl.
• Constants in the head. A violation head position may hold a constant. The nine rules that bound one through Field = "request_hash" now write violation(Session, EntryId, "request_hash").
• Facts, not vacuous rules. The §7.2 default-trust table is a static relation, default_trust, with six facts, replacing six rules with a :- trust(_, _, _) body.
• One typed .output per provision. The three-column violation(provision, subject, witness) relation packed with nested cat and to_string is gone. The differential reads Soufflé's per-provision CSVs into the one-line form the fixtures pin (provision, subject values, witness values), so expected.tsv and the evaluator are unchanged in shape.
• A lineage closure that terminates. ACS-REQ-0010's closure is over (descendant, ancestor) pairs. The path-carrying form did not terminate on a derived_from cycle in either engine, and a trace is untrusted input. The witness names the ancestor and both trust levels; the report's evidence lists the derived_from facts.

What the domain check found

ACS-REQ-0111 compared a step_id from entries_compacted with a provenance_id in derived_from. The spec defines the union in terms of provenance ids, but the payload lists step ids and nothing on the wire ties the two. The rule now reads the mapping from a new Guardian-state relation, step_provenance, and the provision is unevaluated when a Guardian does not supply it, instead of being approximated. Recorded as findings row 8 in the slices doc.

Checks

• tsc, bun test ir (187 pass), every --check (census, markers apply, extract, render, compile, both marker patches), lint: all clean.
• Differential with Soufflé 2.5 locally: conformant 0/0/0, violating 33/33/33 on both engines.
• Soufflé's own type checker was tested against the domain rules before they were written: literals and head constants are accepted in subtype positions, a base-typed count compares with a subtype, and a join or comparison across two subtypes is an error.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BX56nQPAsqYihopWfWy1xm

---

Generated by Claude Code

[github-actions]

Normative impact (ACS 0.1.2 at 6fce2a0)

Nothing added, changed, removed, or unmarked.