{"row":{"id":"ADR-127","title":"nika-runtime size-cap member split: the run's laws descend to nika-runtime-laws","file":"adr-127-nika-runtime-laws-member-split.md","status":"accepted","date":"2026-09-03","cites":8,"supersedes":[],"superseded_by":[],"layers":["L3"],"tags":["architecture","crates","split","size-cap"],"room":true},"pin":{"release_tag":"v0.118.7","commit":"f3a31a6ee00766e4b010379c535bca994631d637"}}

[{"k":"h","depth":1,"text":"ADR-127: nika-runtime size-cap member split — nika-runtime-laws","id":"adr-127-nika-runtime-size-cap-member-split--nika-runtime-laws"},{"k":"h","depth":2,"text":"Context","id":"context"},{"k":"p","inline":[{"k":"code","text":"nika-runtime"},{"k":"text","text":" stands at 14 999 of the 15 000 production lines the\ncrate-size vector allows (vector 24 · the pre-push gate blocks at the\nwall). Wave 7 of the one-door program added the operator's cancellation\nat the wave boundary (ADR-125's session runs through it) and the project\nfingerprint on the opening frame; the next three slices the program\nowes — the terminal frame's summary (#1247), the per-item "},{"k":"code","text":"for_each"},{"k":"text","text":"\nterminals (#1276 · #1397) and the V7 credential seams (S1–S6) — all grow\nthe runtime. Moving code between files inside the crate frees nothing:\nthe counter reads every "},{"k":"code","text":"src/"},{"k":"text","text":" file the index tracks."}]},{"k":"p","inline":[{"k":"text","text":"The cap is a locked maintainability budget, not a suggestion; the\ndescent law (ADR-110 · D-2026-07-09-N1) says a size-cap split is ONE\narchitectural unit in TWO workspace members, the boundary drawn with an\nADR."}]},{"k":"h","depth":2,"text":"Decision","id":"decision"},{"k":"p","inline":[{"k":"text","text":"The run's LAWS — what a run obeys before and after it executes, none of\nwhich dispatches a task or folds a definition — descend to a new L3\nmember crate "},{"k":"code","text":"nika-runtime-laws"},{"k":"text","text":":"}]},{"k":"list","ordered":false,"items":[[{"k":"code","text":"errors"},{"k":"text","text":" (the one-voice "},{"k":"code","text":"RuntimeError"},{"k":"text","text":" and its codes)"}],[{"k":"code","text":"contract"},{"k":"text","text":" (the typed "},{"k":"code","text":"outputs:"},{"k":"text","text":" contract · "},{"k":"code","text":"first_output_type_violation"},{"k":"text","text":")"}],[{"k":"code","text":"compat_record"},{"k":"text","text":" (the public "},{"k":"code","text":"TaskRecord"},{"k":"text","text":" / "},{"k":"code","text":"TaskStatus"},{"k":"text","text":" / "},{"k":"code","text":"TerminalCause"},{"k":"text","text":" mirror)"}],[{"k":"code","text":"origins"},{"k":"text","text":" ("},{"k":"code","text":"InputOrigin"},{"k":"text","text":" · "},{"k":"code","text":"input_origins"},{"k":"text","text":")"}],[{"k":"code","text":"identity"},{"k":"text","text":" (the engine identity · the build-support pins)"}],[{"k":"code","text":"integrity"},{"k":"text","text":" (the record integrity law · "},{"k":"code","text":"ValueTaint"},{"k":"text","text":")"}],[{"k":"code","text":"secret"},{"k":"text","text":" ("},{"k":"code","text":"WorkflowSecretResolver"},{"k":"text","text":" · "},{"k":"code","text":"RedactingSink"},{"k":"text","text":" · the payload\nfield list — the V7 custody seams' future home)"}],[{"k":"code","text":"sandbox_select"},{"k":"text","text":" (the sandbox verdict for a command)"}],[{"k":"code","text":"witness"},{"k":"text","text":" · "},{"k":"code","text":"stamp"},{"k":"text","text":" (the event stamp seams the laws write through)"}],[{"k":"code","text":"resume_fields"},{"k":"text","text":" (the resume projection's payload field names the\nsecret custody reads)"}]]},{"k":"p","inline":[{"k":"text","text":"The boot trust judgement ("},{"k":"code","text":"trust"},{"k":"text","text":") and the semantic IR ("},{"k":"code","text":"proof::ir"},{"k":"text","text":")\nstay in the runtime: both read the definition fold ("},{"k":"code","text":"definition_value"},{"k":"text","text":"\nand its helper family), which is the resume projection's and stays with\nit."}]},{"k":"p","inline":[{"k":"code","text":"nika-runtime"},{"k":"text","text":" re-exports every public item at its historical path\n("},{"k":"code","text":"nika_runtime::{RuntimeError, TaskRecord, TaskStatus, TerminalCause, InputOrigin, input_origins, WorkflowSecretResolver, identity, sandbox_select, resume::fields, EventSink, Stamper, …}"},{"k":"text","text":"), so call sites\nin "},{"k":"code","text":"nika-cli"},{"k":"text","text":", "},{"k":"code","text":"nika-cli-host"},{"k":"text","text":", "},{"k":"code","text":"nika-service-execution"},{"k":"text","text":", "},{"k":"code","text":"nika-serve"},{"k":"text","text":",\n"},{"k":"code","text":"nika-session"},{"k":"text","text":" and the tests stay untouched. The laws' crate-private\nseams the core reaches ("},{"k":"code","text":"TaskContract"},{"k":"text","text":" · "},{"k":"code","text":"ValueTaint"},{"k":"text","text":" · "},{"k":"code","text":"task_integrity"},{"k":"text","text":"\n· "},{"k":"code","text":"scrub_outputs"},{"k":"text","text":" · "},{"k":"code","text":"SandboxDecision"},{"k":"text","text":" · the witness aliases) are "},{"k":"code","text":"pub"},{"k":"text","text":"\nin the member and "},{"k":"code","text":"pub(crate)"},{"k":"text","text":" re-imports in the runtime."}]},{"k":"h","depth":2,"text":"Alternatives rejected","id":"alternatives-rejected"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"Descending the composition root ("},{"k":"code","text":"compose"},{"k":"text","text":" · "},{"k":"code","text":"harness_seat"},{"k":"text","text":" ·\n"},{"k":"code","text":"simulated"},{"k":"text","text":"): it depends ON the runtime (it builds "},{"k":"code","text":"Runtime<…>"},{"k":"text","text":"), so\nthe operator crate could not re-export it — every consumer would\nswitch imports, and the public surface would fork."}],[{"k":"text","text":"Descending "},{"k":"code","text":"trust"},{"k":"text","text":" and "},{"k":"code","text":"proof::ir"},{"k":"text","text":" with the laws: they read the\ndefinition fold, which would have dragged the resume projection\n(a runtime-core subsystem) into the member or duplicated it."}],[{"k":"text","text":"A file split inside the crate: moves no production line out of the\nbudget (the counter is the crate's, not a file's)."}],[{"k":"text","text":"Raising the cap: the cap exists to force exactly this."}]]},{"k":"h","depth":2,"text":"Consequences","id":"consequences"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"Vector 24 returns GREEN with real headroom ("},{"k":"code","text":"nika-runtime"},{"k":"text","text":" 13 234\nlines · 1 766 below the wall · "},{"k":"code","text":"nika-runtime-laws"},{"k":"text","text":" ≈ 1.8k; the boot\ntrust and the semantic IR stayed with the definition fold, so the\nmember is smaller than the draft's 3.3k)."}],[{"k":"code","text":"nika-runtime-laws"},{"k":"text","text":" is a member of the "},{"k":"code","text":"nika-runtime"},{"k":"text","text":" unit, not a\nnew architectural unit: the same L3 row, "},{"k":"code","text":"publish = false"},{"k":"text","text":", one\npublic surface re-exported by the operator crate."}],[{"k":"text","text":"A new "},{"k":"code","text":"crates/nika-runtime-laws/public-api.txt"},{"k":"text","text":" baseline joins the\ndiff gate; "},{"k":"code","text":"crates/nika-runtime/public-api.txt"},{"k":"text","text":" re-baselines (items\nbecome re-exports)."}],[{"k":"text","text":"The V7 credential seams (S1–S6) land in the member: "},{"k":"code","text":"secret"},{"k":"text","text":" is\ntheirs."}],[{"k":"text","text":"The next growth inside "},{"k":"code","text":"nika-runtime"},{"k":"text","text":" should descend the pause /\napproval / resume plane (≈ 2.4k) before the wall bites again."}]]},{"k":"h","depth":2,"text":"Security boundary","id":"security-boundary"},{"k":"p","inline":[{"k":"text","text":"No trust boundary moves. The laws keep their seams inside the member;\nthe operator crate reaches them through the same paths. The secret\nresolver's zeroizing type and the redacting sink are moved, not changed."}]},{"k":"h","depth":2,"text":"Rollback","id":"rollback"},{"k":"p","inline":[{"k":"text","text":"Reverse "},{"k":"code","text":"git mv"},{"k":"text","text":" + drop the member from the workspace "},{"k":"code","text":"members"},{"k":"text","text":" and\nfrom "},{"k":"code","text":"nika-runtime"},{"k":"text","text":"'s dependencies; the re-exports become definitions\nagain. One commit."}]}]

ADR-127

nika-runtime size-cap member split: the run's laws descend to nika-runtime-laws

accepted · 2026-09-03 · L3 · cites 8

ADR-127: nika-runtime size-cap member split — nika-runtime-laws #

Context #

nika-runtime stands at 14 999 of the 15 000 production lines the crate-size vector allows (vector 24 · the pre-push gate blocks at the wall). Wave 7 of the one-door program added the operator's cancellation at the wave boundary (ADR-125's session runs through it) and the project fingerprint on the opening frame; the next three slices the program owes — the terminal frame's summary (#1247), the per-item for_each terminals (#1276 · #1397) and the V7 credential seams (S1–S6) — all grow the runtime. Moving code between files inside the crate frees nothing: the counter reads every src/ file the index tracks.

The cap is a locked maintainability budget, not a suggestion; the descent law (ADR-110 · D-2026-07-09-N1) says a size-cap split is ONE architectural unit in TWO workspace members, the boundary drawn with an ADR.

Decision #

The run's LAWS — what a run obeys before and after it executes, none of which dispatches a task or folds a definition — descend to a new L3 member crate nika-runtime-laws:

errors (the one-voice RuntimeError and its codes)
contract (the typed outputs: contract · first_output_type_violation)
compat_record (the public TaskRecord / TaskStatus / TerminalCause mirror)
origins (InputOrigin · input_origins)
identity (the engine identity · the build-support pins)
integrity (the record integrity law · ValueTaint)
secret (WorkflowSecretResolver · RedactingSink · the payload field list — the V7 custody seams' future home)
sandbox_select (the sandbox verdict for a command)
witness · stamp (the event stamp seams the laws write through)
resume_fields (the resume projection's payload field names the secret custody reads)

The boot trust judgement (trust) and the semantic IR (proof::ir) stay in the runtime: both read the definition fold (definition_value and its helper family), which is the resume projection's and stays with it.

nika-runtime re-exports every public item at its historical path (nika_runtime::{RuntimeError, TaskRecord, TaskStatus, TerminalCause, InputOrigin, input_origins, WorkflowSecretResolver, identity, sandbox_select, resume::fields, EventSink, Stamper, …}), so call sites in nika-cli, nika-cli-host, nika-service-execution, nika-serve, nika-session and the tests stay untouched. The laws' crate-private seams the core reaches (TaskContract · ValueTaint · task_integrity · scrub_outputs · SandboxDecision · the witness aliases) are pub in the member and pub(crate) re-imports in the runtime.

Alternatives rejected #

Descending the composition root (compose · harness_seat · simulated): it depends ON the runtime (it builds Runtime<…>), so the operator crate could not re-export it — every consumer would switch imports, and the public surface would fork.
Descending trust and proof::ir with the laws: they read the definition fold, which would have dragged the resume projection (a runtime-core subsystem) into the member or duplicated it.
A file split inside the crate: moves no production line out of the budget (the counter is the crate's, not a file's).
Raising the cap: the cap exists to force exactly this.

Consequences #

Vector 24 returns GREEN with real headroom (nika-runtime 13 234 lines · 1 766 below the wall · nika-runtime-laws ≈ 1.8k; the boot trust and the semantic IR stayed with the definition fold, so the member is smaller than the draft's 3.3k).
nika-runtime-laws is a member of the nika-runtime unit, not a new architectural unit: the same L3 row, publish = false, one public surface re-exported by the operator crate.
A new crates/nika-runtime-laws/public-api.txt baseline joins the diff gate; crates/nika-runtime/public-api.txt re-baselines (items become re-exports).
The V7 credential seams (S1–S6) land in the member: secret is theirs.
The next growth inside nika-runtime should descend the pause / approval / resume plane (≈ 2.4k) before the wall bites again.

Security boundary #

No trust boundary moves. The laws keep their seams inside the member; the operator crate reaches them through the same paths. The secret resolver's zeroizing type and the redacting sink are moved, not changed.

Rollback #

Reverse git mv + drop the member from the workspace members and from nika-runtime's dependencies; the re-exports become definitions again. One commit.

read at v0.118.7 · the decision record ships with the engine

Every decision, with its status This one in the repo