chore - layout step 3: split the root crate into compiler and oven crates with an Incan-free Oven ring

[dannymeijer]

Area

• Compiler (frontend/backend/codegen)
• Tooling (CLI/formatter/test runner)
• Runtime / Core crates (stdlib/core/derive)

Summary

Step 3 of the workspace layout rewrite (parent: #1478). Split what remains of the root crate into incan_frontend, incan_ir, incan_emit, incan_format, incan_inspect, incan_oven_facet, and the Oven crates oven_model, oven_store, oven_rustc, oven_interop, oven_cargo_compat (with oven_registry reserved, empty). Relocate the root tests/ to the crates that own the behavior. Turn on the Oven-only compile guard.

The Oven boundary is the load-bearing part. Measured on dev.4, the proposed Oven sources reach into Incan rings in exactly these places, each of which moves to incan_oven_facet or becomes internal: oven/rustc.rs → cli::commands::build (internal after #1266); oven/legacy_cargo.rs → SDK inventory discovery, provider digests, backend::project::runner; oven/loaf.rs and dependency_resolver.rs → incan_core::lang::stdlib::StdlibExtraCrateSource; lockfile.rs → provider::*, library_manifest::*, frontend::LibraryManifestIndex; dependency_resolver.rs → frontend::ast::Span, frontend::diagnostics::CompileError; backend/project/runner.rs → cfg-gated rust_inspect calls. The full table is in loaves/LAYOUT.md under "The Oven boundary".

Scope

• In scope: the crate split; lockfile.rs and dependency_resolver.rs split into generic Oven halves and Incan-specific facet halves; the rust_inspect hook inversion in runner.rs; tests/ relocation per the disposition table; the CI guard.
• Out of scope: behavior change; oven_registry implementation (RFC 125); the ra_ap_load-cargo to project-JSON loader change in incan_inspect (its own follow-up; the crate boundary does not depend on it); directory moves into loaves/ (step 4).
• Risks: lockfile.rs embeds SDK-provider and library-manifest types in the lock schema, so the split needs an extension point in oven_model rather than a copy of the types. oven/rustc.rs is 10.5k lines and Oven failures surface as authority and fingerprint errors rather than compile errors; verify with the Oven replay lanes, not unit tests alone.

Plan

1. incan_frontend, incan_ir, incan_emit, incan_format first: pure moves, snapshots must not change.
2. oven_model, oven_store, oven_rustc, oven_interop, oven_cargo_compat next, with incan_oven_facet created in the same PR series so the facet absorbs each outward edge as it is cut.
3. incan_inspect from crates/rust_inspect plus src/rust_inspect/.
4. Relocate tests/: codegen and lowering to incan_emit; parity corpus, replacement, generated-Rust artifact and audit tests to incan_driver; CLI integration and layering guardrails to the CLI crate; Oven regressions to oven_rustc; property tests split by subject; fixtures beside their tests.
5. Add to CI: cargo check -p oven_model -p oven_store -p oven_rustc -p oven_registry -p oven_interop -p oven_cargo_compat in a checkout with the compiler crates absent.

Done when

• The Oven-only cargo check passes in CI with no compiler crates present.
• No oven_* crate lists an incan_* crate as a dependency.
• make test passes; codegen snapshots unchanged; the root tests/ directory is empty.

[dannymeijer]

Plan of attack

Measured on the #1573 tree (the root crate after steps 0–2), counting crate::<module> references between top-level modules of src/:

module	lines	reaches
frontend	132k	backend 27 (all tests and doc links but one test-gated site), provider 23, version 13, rust_inspect 5, semantics_registry 4, library_manifest 4, toolchain_layout 2, manifest 2, driver 2 (tests), replacement_compatibility 2
backend	105k	frontend 376, library_manifest 128, provider 46, version 34, oven 30, manifest 20, rust_inspect 8, cli 7
oven	68k	oven_interop 11, manifest 6, toolchain_layout 6, library_manifest 5, version 3, provider 2
driver	34k	oven 289, frontend 172, provider 67, manifest 53, library_manifest 40, backend 39, lockfile 27, rust_inspect 24, dependency_resolver 18
provider	11k	library_manifest 32, frontend 19, version 15, oven 14, toolchain_layout 11, manifest 10
lockfile	2.9k	oven_interop 13, provider 9, library_manifest 8, version 3, frontend 2, backend 1
dependency_resolver	1.2k	frontend 3, lockfile 2, manifest 1

Three things the measurement settles before the first crate exists:

1. The provider's contract half is the frontend's. ProviderPlan, ProviderIdentity, ProviderProvenance, ProviderModuleResolution, PublicProviderArtifact (provider/plan.rs) are read by the typechecker through ten methods; the plan is built from SdkInventory/ResolvedSdkComponents (sdk.rs) and PackageFeaturePlan (features.rs), and all three read the manifest model that chore - 1478 the frontend owns the library manifest model #1568 already made frontend::library_manifest because it embeds symbols/ast/library_exports. So incan_frontend takes provider/{plan,sdk,features,error} as its provider module, and incan_provider keeps the loaders and builders that talk to Oven and the compiler stack: inventory (discovery), requirements, sdk_store, sdk_build, vocab_extraction, effect_digest, library_manifest/artifact.rs, compiled_sdk, semantics_registry. That is the amendment chore - 1478 the frontend owns the library manifest model #1568 implied, written down.
2. incan_frontend may depend on oven_model. The frontend reads manifest::ProjectManifest (module resolution, the manifest index), toolchain_layout::find_stdlib_source_file (stdlib loader) and DependencySpec; all three are oven_model. The ring rule only forbids Oven reaching into Incan; a compiler crate consuming oven_model keeps the arrows inward and the Oven-only check intact. The frontend README's "kernel + provider contract" becomes "kernel, oven_model, and its own provider contract".
3. incan_inspect is two crates' worth and stays split. The typechecker uses crates/rust_inspect (the rust-analyzer-backed inspector, below the frontend) under the rust_inspect feature; src/inspect/ (codegraph export, 4.8k lines) reaches the driver and sits above it. crates/rust_inspect + src/rust_inspect/mod.rs are incan_inspect; src/inspect/ goes with the driver.

PRs into 0.6.0-dev.5, each moves-only and green on the step-1 gates:

• 3a — the frontend reaches nothing above it. version.rs → incan_core (kernel; the root re-exports), the ReplacementCompatibilityContribution builder out of body_ir.rs into replacement_compatibility.rs, the frontend tests that drive the backend (executable_resolution/tests.rs, parts of typechecker/tests.rs, body_ir/tests.rs) to the backend side, provider/{plan,sdk,features,error} under frontend::provider. Exit: grep -r 'crate::(backend|driver|provider|replacement_compatibility|inspect|cli|lsp|oven)' src/frontend is empty outside #[cfg(test)].
• 3b — incan_frontend, incan_format. git mv src/frontend loaves/compiler/incan_frontend/src and src/format, crate::frontend:: → incan_frontend:: everywhere, the root re-exports pub use incan_frontend as frontend so nothing else moves in the same PR. Snapshots unchanged.
• 3c — incan_ir, incan_emit. backend/ir/lower + IR types + numeric_adapters → incan_ir; backend/ir/emit, conversions, codegen, backend/replacement → incan_emit. backend/project/generator.rs stays in the root until the driver crate. The backend → cli reaches (7) are cut here.
• 3d — the Oven ring. oven_model (manifest, workspace, project_lifecycle, toolchain_layout, the generic halves of lockfile and dependency_resolver), oven_store, oven_rustc (+ backend/project/{plan,lock_projection,mod}), oven_interop, oven_cargo_compat (legacy_cargo, cargo_toml, runner with the rust_inspect hook inverted), oven_registry empty; incan_oven_facet takes the six edges in loaves/LAYOUT.md's boundary table as they are cut. The Oven-only cargo check becomes a CI job in this PR.
• 3e — incan_provider, incan_driver, the binaries' crates, tests/ relocation per the disposition table, tests/support as a dev-crate, the CLI layering and vocab guardrails re-rooted to the crate graph. chore - verify dependency closure after ring migration and Loaf adoption #1483 closes here with cargo udeps on the new graph.

Gates per PR: the six build configurations, both clippy gates, rustdoc gate last, the three fixture-keyed guardrail suites, make test-one on one exact root per touched Oven path; codegen snapshots unchanged on 3b/3c; make test locally once at 3e with the accepted local-only failures listed; the heavy lane once on the dev.5 → main PR.

[dannymeijer]

Amendment — 3d, the Oven ring, measured on the 3c tree

src/oven and oven.rs (43k lines) are one strongly connected component: loaf → rustc (21) and rustc → loaf (3); legacy_cargo → loaf (11), rustc (6) and rustc → legacy_cargo (1), loaf → legacy_cargo (11 imported items — the Loaf bake runs on the compat baker's prepare_direct_rustc_plan, direct_rustc_compile_environment and closure types), plan → legacy_cargo (3), native_contract → legacy_cargo (its payload types are re-exports), interop → rustc (5), loaf → interop (1). Only store, store_mirror, closure_proof, progress and process reach nothing.

So the ring arrives in two crates, not five:

• oven_store: store, store_mirror, closure_proof, progress, process — the leaf.
• oven_rustc: rustc/, loaf/, loaf_mirror, plan/, native_test/, native_contract, interop, legacy_cargo/ and oven.rs as its root — the component. oven_cargo_compat and oven_interop stay modules inside it until the cycles above are cut; that is a refactor of the Loaf bake path, not a move, and it does not change the ring property: cargo check of oven_model + oven_store + oven_rustc in a workspace with no compiler crates is the same test.

The Oven sources name Incan in eight places, and every one of them is an input the compiler can hand over as data:

• INCAN_VERSION/SDK_PROVIDER_CODEGEN_REVISION in store.rs (active_release_domain) and loaf.rs (envelope inputs): the compiler's identity becomes a value the caller passes — the store learns its release through OvenStore::with_release, the Loaf request carries the identity; nothing in the ring reads the compiler's env!.
• legacy_cargo's SDK staging (SdkInventory::read_from_path, discover_active_sdk_inventory, refresh_staged_sdk_provider_digests with LibraryManifest and digest_provider_artifact, SDK_INVENTORY_FILE, LIBRARY_MANIFEST_EXTENSION) is Incan provider logic executed by the compat publisher: it moves to incan_oven_facet behind a CompatProviderHooks trait the request carries (resolve the SDK root, refresh the staged provider digests).
• oven.rs::digest_dependency_specs's packaged-provider branch (is_packaged_provider_root + digest_provider_artifact) becomes a hook on the same trait; the generic digest_cargo_path_source_tree_with_cache and digest_toolchain_source_tree_with_cache (a tree digest with a memo, no manifest types) move to oven_model::digest.

lockfile.rs and dependency_resolver.rs are not imported by anything under src/oven, so their generic/facet split (3d-2) follows on its own. The first facet crate, incan_oven_facet, appears with 3d-1 and holds the hook implementations; the driver constructs it.

[dannymeijer]

3d-1 amendment (#1578), measured on the 3c tree before cutting.

The receipt model goes to oven_store, not oven_rustc. src/oven.rs is the receipt model whole — OvenReceipt, OvenBuildIntent, OvenError, the requests, source-tree digests, import_frozen_project. store.rs needs OvenReceipt, OvenBuildIntent and digest_bytes from it; the root needs nothing from rustc, loaf, plan, legacy_cargo or interop (its one submodule reference is process::id, which is std). So oven.rs becomes oven_store's crate root with store, store_mirror, closure_proof, progress and process, and oven_rustc — rustc/, loaf/, loaf_mirror, plan/, native_test/, native_contract, interop, legacy_cargo/, the Loaf fixtures — depends on it. loaves/LAYOUT.md already puts "receipts, identities" under oven_store; its "loaf.rs → oven_store" line is the one that does not survive measurement (loaf reaches rustc 21 times and legacy_cargo 3).

The compiler's two facts arrive as data. oven_model::compiler_identity::CompilerIdentity (version + SDK provider codegen revision) replaces the INCAN_VERSION/SDK_PROVIDER_CODEGEN_REVISION reads in store.rs and loaf.rs; oven_store::OvenProviderHooks (SDK provider root, inventory file name, staged-digest refresh, packaged-provider digest) replaces the five provider/library_manifest reads in legacy_cargo, sdk_staging and oven.rs. Both ride the existing requests (OvenStore::with_release, OvenLoafBakerContext, OvenLegacyCargoPrepareRequest). The tree-digest cluster from library_manifest/artifact.rs was generic and moved to oven_model::digest. Nothing under loaves/oven names an Incan crate; make check-oven-ring proves it for three crates.

incan_oven_facet is not a crate in 3d-1. src/oven_facet.rs holds compiler_identity(), provider_hooks() and IncanProviderHooks, and the hooks read SdkInventory and discover_active_sdk_inventory from src/provider/ — the loaders that become incan_provider in 3e. The facet becomes a crate in the same PR as the provider.

Two loaf.rs tests checked Incan facts against Oven's fixtures (that the complete-stdlib Loaf fixtures cover every checked SDK component module; that the envelope's inspection surface equals incan_core::lang::stdlib::extra_crate_deps()). They are the facet's tests now. interop and legacy_cargo stay modules of oven_rustc; oven_interop and oven_cargo_compat wait for their edges into loaf/rustc to be cut, and oven_registry for RFC 125.

3d-2, measured item by item. lockfile.rs is 46 generic items (610 lines — IncanLock, SemanticLockState, the Locked* records, all plain strings and sets; parse, write, the publication lock, the fingerprints) and 13 Incan-typed ones (468 lines — semantic_lock_state and the sealed-reading helpers, which compute that state from ProviderPlan, SdkInventory and ResolvedSdkComponents), plus one INCAN_VERSION read in the constructor. So the generic half becomes oven_model::lock as it is, with the constructor taking the compiler's version, and the Incan half becomes provider::lock_semantics (the incan_provider crate's in 3e); no extension point, the model was already data. dependency_resolver.rs is 20 items of which the eight that matter carry Span and CompileError: it merges Incan's inline from rust::… imports into the manifest's dependencies and every error is a compiler diagnostic at an import site; nothing under loaves/oven uses it. It goes to the driver crate in 3e, not to oven_model — LAYOUT's row for it does not survive the measurement.

[dannymeijer]

3d-2 is #1579, and one line of the amendment above does not survive the next measurement: dependency_resolver.rs goes with incan_provider, not the driver — provider/requirements.rs reads ResolvedDependencies from it, so it sits at or below the provider. Everything else it said holds: it merges Incan's inline imports and speaks compiler diagnostics, so it is compiler-ring code either way, never oven_model's. compiler_stack.rs (113 lines, std only) is in the same position — provider/sdk_store.rs runs on it — and moves with the provider or into the frontend, whose recursion it guards; decided when 3e-1 cuts.

3e, measured on the 3d-1 tree (root module → root module reaches; the ring crates already split out are left out): provider → compiler_stack 1, dependency_resolver 1. driver (34k lines) → provider 67, backend 42, lockfile 27, rust_inspect 24, dependency_resolver 18, oven_facet 11, generated_cache 5, compiled_sdk 4. inspect (codegraph) → driver 7. backend/{project,shadow} (12k) → provider 13, cli 7 (all shadow_support from the shadow tests). cli (28k) → driver 131, provider 26, backend 17. lsp (12k) → driver 8, provider 5. oven_facet → provider 2. So the order is: incan_provider (provider/, compiled_sdk, dependency_resolver) with incan_oven_facet beside it; then incan_driver (driver/, backend/{project,shadow} wholesale — the Oven-ward moves of plan/lock_projection/cargo_toml/runner need their own inversions and wait — generated_cache, replacement_compatibility, inspect/); then toolchain/incan-cli (cli/ and main.rs, keeping the oven, lock and tools commands: an oven binary is a product decision, not a move, so toolchain/oven-cli stays a skeleton until it is one) and toolchain/incan-lsp; tests/ last, with the root crate alive until then because the suite harness and the compiler-suite receipt enumerate tests/.

[dannymeijer]

Step 3 has landed on 0.6.0-dev.5 (c2e786210): #1576, #1577, #1578, #1579, #1580, #1581 — incan_format, incan_frontend, incan_ir, incan_emit, oven_model (with the lock model), oven_store, oven_rustc, incan_provider, incan_oven_facet, incan_driver, and the root keeps every old path as a shim. The review round on the stack fixed the SDK effect digest (it had kept folding src/backend after lowering and emission left it; loaves/compiler/incan_ir/src, incan_emit/src and incan_driver/src/backend are the roots now), took incan_stdlib out of the compiler crates' normal dependencies with tests/layering_guard.rs scanning every ring manifest, and gave OvenProviderHooks a typed error.

Against the Done-when list: the Oven-only check runs in CI (make check-oven-ring, Clippy lane) and no oven_* crate names an incan_* crate — both hold. The root tests/ directory is not empty: relocating it, and the binaries into loaves/toolchain/, is deferred to the version-bump step because it changes the public cargo install … --bin incan spelling and the suite harness's tests/ enumeration (3e-3 on #1478); make test on the merged line runs with the dev.5 → main PR's heavy lane. oven_interop and oven_cargo_compat are still the skeleton crates — oven_rustc::interop and legacy_cargo are where that code lives until the Oven-ward inversions of backend/project/{plan,lock_projection,cargo_toml,runner} — and crates/rust_inspect moved to loaves/compiler/rust_inspect as it is; the incan_inspect consolidation with src/rust_inspect/ belongs with the step 5 renames. This issue stays open for 3e-3.