From df0bad837551ad4a0cec85db509535e8e65aab8c Mon Sep 17 00:00:00 2001
From: mfw78 <mfw78@nxm.rs>
Date: Fri, 17 Jul 2026 02:30:04 +0000
Subject: [PATCH] ci: align the zero-leak check to the charter symbol set

Scan the runtime sources for the charter set only (nexum:intent,
value-flow, VenueAdapter, synthesize_venue, nexum:adapter, PoolRouter),
dropping the loose word-shape sweep that false-flagged the opaque
extension-map fixtures; keep the crate-graph and WIT-leaf checks, and
state the invariant in the nexum-runtime crate charter. The CI job
stays advisory until the physical repo cut.
---
 .github/workflows/ci.yml        |  8 ++++----
 crates/nexum-runtime/src/lib.rs |  5 +++++
 scripts/check-venue-agnostic.sh | 22 ++++++++++++----------
 3 files changed, 21 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 42cc34c0..debe6ad1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -144,10 +144,10 @@ jobs:
           AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
         run: cargo check --workspace --all-features --locked --target aarch64-unknown-linux-gnu
 
-  # Advisory guard that nexum-runtime stays venue-agnostic: crate graph, symbol
-  # scan, and nexum:host WIT leaf-ness (scripts/check-venue-agnostic.sh).
-  # `continue-on-error` keeps this a signal, not a gate, until the physical
-  # host cut lands; the flip to a blocking gate is tracked for M2.
+  # Advisory zero-leak guard that nexum-runtime stays venue-agnostic: crate
+  # graph, charter symbol scan, and nexum:host WIT leaf-ness
+  # (scripts/check-venue-agnostic.sh). `continue-on-error` keeps this a
+  # signal, not a gate; it flips to a required check at the physical repo cut.
   venue-agnostic:
     name: venue-agnostic (advisory)
     runs-on: ubuntu-latest
diff --git a/crates/nexum-runtime/src/lib.rs b/crates/nexum-runtime/src/lib.rs
index 1d200b90..b4cccbdd 100644
--- a/crates/nexum-runtime/src/lib.rs
+++ b/crates/nexum-runtime/src/lib.rs
@@ -1,6 +1,11 @@
 //! Nexum runtime: a wasmtime-based host for WASM Component Model
 //! modules, usable as an embeddable library. The bundled binary is a
 //! thin consumer of the same public surface.
+//!
+//! Zero-leak charter: this crate is settlement-domain-agnostic. It
+//! carries no domain symbol or WIT reference, `nexum:host` stays a
+//! leaf WIT package, and no crate edge reaches a domain crate. The
+//! zero-leak script under `scripts/` enforces this in CI.
 
 #![cfg_attr(not(test), warn(unused_crate_dependencies))]
 
diff --git a/scripts/check-venue-agnostic.sh b/scripts/check-venue-agnostic.sh
index 26d60d3a..86da679f 100755
--- a/scripts/check-venue-agnostic.sh
+++ b/scripts/check-venue-agnostic.sh
@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
-# Venue-agnosticism check for the host layer: no host-layer crate graph
+# Zero-leak check for the host layer: no host-layer crate graph
 # (runtime, launcher, bare engine) reaches a videre/intent/venue/cow
-# crate, the runtime sources carry no venue symbol, and nexum:host
-# resolves as a leaf WIT package. Advisory in CI until the physical cut
-# lands; run locally via `just check-venue-agnostic`.
+# crate, the runtime sources carry no charter symbol
+# (nexum:intent|value-flow|VenueAdapter|synthesize_venue|nexum:adapter|PoolRouter),
+# and nexum:host resolves as a leaf WIT package. Advisory in CI until
+# the physical cut lands; run locally via `just check-venue-agnostic`.
 
 set -uo pipefail
 
@@ -34,14 +35,15 @@ for crate in nexum-runtime nexum-launch nexum-cli; do
     fi
 done
 
-# 2. Symbol scan: no venue vocabulary anywhere in the crate. Word shapes
-#    skip std::borrow::Cow, ProviderError, and "intentional".
-symbols='\b[Vv]idere|\b[Ii]ntent([_A-Z-]|s?\b)|\b[Vv]enue|\bcow|CoW|\bCow[A-Z]'
-rg -n --no-heading -e "$symbols" crates/nexum-runtime
+# 2. Symbol scan: the charter set (forbidden WIT namespaces, the old
+#    router and adapter names). Section 1 guards dependency edges; this
+#    scan stays curated so opaque extension payloads never false-flag.
+charter='nexum:intent|value-flow|VenueAdapter|synthesize_venue|nexum:adapter|PoolRouter'
+rg -n --no-heading -e "$charter" crates/nexum-runtime/src
 case $? in
-    0) fail "venue symbols leak into nexum-runtime" ;;
+    0) fail "charter symbols leak into nexum-runtime" ;;
     1) pass "symbol scan empty" ;;
-    *) fail "symbol scan errored (crates/nexum-runtime missing?)" ;;
+    *) fail "symbol scan errored (crates/nexum-runtime/src missing?)" ;;
 esac
 
 # 3. WIT DAG: nexum:host is a leaf. No cross-package use/import, and the