Build-Authorized Evidence for Opaque Calls: A Fail-Closed Rewrite-Authority Boundary

2026-07-21

AI Summary

This work addresses the security authorization problem of compiler rewrites in opaque calls, ensuring that such rewrites are confined exclusively to trusted contexts—including build environments, callers, callback environments, observation points, and runtime targets. It proposes a build-authorization-based path-effect interface that enforces permission boundaries within the compiler through fail-closed mechanisms and link receipts. Innovatively decoupling receipt closures, callback environment closures, and projected identities, the approach establishes explicit trust boundaries that prevent permission amplification and enable precise conditional refinement. Evaluated using Rocq formal verification, LLVM’s narrow API, the Toka checking framework, a topology-preserving IR subset, and Darwin/arm64 static branch validation, the method successfully preserves opaque calls in scenarios such as readv, recvmsg, and Cairo—halving load operations without altering semantics—while correctly rejecting unsafe cases like libjpeg with open callback environments.

Abstract

Detached semantic facts about opaque native providers do not by themselves justify compiler rewrites: rewrite authority must be confined to the accepted fact, selected provider and build, caller, callback environment, observation, and runtime target. We present a build-authorized path-effect interface that enforces this boundary through fail-closed authorization and link receipts. The design separates receipt closure, callback-environment closure, and projection identity, and passes accepted facts to LLVM through a narrow internal API. We use one-hop topology-load reuse as a minimal observable witness of authority, not as the optimization target. A conservative LLVM consumer reuses a pointer observation only from a noalias root or one constant nonzero projection. Rocq models prove conditional refinement and authority non-amplification under explicit effect, alias, compiler/ABI, and target-resolution premises. We instantiate checked production with Toka: a source-summary gate emits exact LLVM IR, a separate IR checker accepts only a bounded topology-preserving subset, and only accepted IR is compiled into the receipt-bound provider object. A bounded static Darwin/arm64 profile also checks the final direct branch target. Across issuer-declared readv, recvmsg, and Cairo boundaries, authorized IR retains each opaque call, reduces the relevant loads from two to one, and preserves observed results; mismatched providers, builds, callbacks, projections, and unsupported IR remain neutral. A libjpeg case is rejected because its callback environment is open, while a bound callback singleton demonstrates the supported closure rule. The contribution is a checked deployment-compiler boundary with an explicit trust and applicability frontier, not a uniquely expressive effect encoding or a new load-elimination algorithm.

Problem

• opaque calls
• rewrite authority
• build authorization
• compiler boundary
• fail-closed

Innovation

• fail-closed authorization
• build-authorized evidence
• opaque calls
• path-effect interface
• receipt-bound compilation