Language contracts

Prove the write before it happens.

For R&D, advanced contract users, and people modeling agentic, financial, payment, or gated-data boundaries. @trust types who may cross. trust:: proves a write. @secure is the envelope before the body. The compiler fails closed when those facts conflict.

Three reference contracts Install DAL

1 · Blast radius

A decentralized slice cannot call the model

On-chain-only services (@trust("decentralized")) may use chain::. Orchestration namespaces such as ai:: and fs:: are a type-check failure, not a runtime warning. Put research on hybrid or centralized services; keep settlement narrow.

Expected fail · exit 1

dal check dist_agent_lang/examples/fixtures/trust_rules_decentralized_rejects_ai.dal

Diagnostic: disallowed namespace ai on decentralized service BadOnChainSlice.

Source on GitHub

Expected pass · exit 0

dal check dist_agent_lang/examples/verify_trust_contract_rules.dal

OnChainAnchor in that file is decentralized + chain:: only — it type-checks.

Source on GitHub

2 · Claim

Who may cross vs what is proven before a write

Hybrid attributes type the crossing (@web, @ai, @chain, @admin). trust::authorize is the capability check before chain::deploy — the stand-in for pay, unlock, or gated state. A registered admin proceeds; a stranger is denied and the mutation is skipped.

Expected pass · exit 0

dal run dist_agent_lang/examples/verify_trust_contract_claim.dal

Watch for PermissionDenied on admin::kill without @admin, then stranger skipped vs ops_admin deployed.

Source on GitHub

3 · Rules

The envelope is typed: @secure is not @public

@secure means callable if authenticated, with a reentrancy guard before the body. @public means no auth. Both on one service is a type error. Unauthenticated credit is AccessDenied. Nested re-entry is ReentrancyDetected. A public gas read has no auth envelope.

Expected fail · exit 1

dal check dist_agent_lang/examples/fixtures/trust_rules_secure_public_conflict.dal

Mutually exclusive attributes on ConflictingCaps.

Source on GitHub

Expected fail · exit 1

dal build dist_agent_lang/examples/fixtures/trust_rules_decentralized_rejects_try_catch.dal --target mobile

Decentralized v1 rejects try/catch. Dynamic control flow stays off the settlement slice.

Source on GitHub

Expected pass · exit 0

dal run dist_agent_lang/examples/verify_trust_contract_rules.dal

Unauthenticated credit blocked; after chain::set_caller, credit proceeds; re-entry blocked; public read ok.

Source on GitHub

Truth

The language repo is the contract

These commands were recorded against dal v1.1.2. If a page and the compiler disagree, the compiler wins. Implementation: src/stdlib/trust.rs. Attributes: docs/attributes.md. Envelope: docs/guides/SECURE_ATTRIBUTE_USAGE.md.

dist_agent_lang on GitHub Trust boundary as data Trust-split