feat(typed-builder): TB-MVP-01 Order vertical slice (generator, ASP.NET Core + EF Core sample, gate)

Implements docs/notes/tb-mvp-01-preregistration.md:

- frontend/roslyn/Own.TypedBuilder: a syntax-only generator. From one
  annotated declaration ([TypedProtocol], [ProtocolState], [BuilderRequired],
  [Transition]) it writes the state tokens, transitions, checked region
  entries, strict state storage and a staged builder. Output is deterministic
  and committed (not *.g.cs: the extractor must scan it as source).
- samples/OrderBackend: one ordinary EF Core Order entity under all typed
  states, a minimal API with create/submit/approve/ship/get/list, SQLite. A
  pure helper inside the Ship region goes through H1 proven_call.
- corpus: 8 positive, 20 negative (compiler / extractor / core), 2 stated
  limits, each pinned to its registered answer.
- Acceptance: real HTTP on real SQLite, with raw-SQL, ChangeTracker and HTTP
  oracles outside the typed API; fixed clock, deterministic transcript.
- scripts/typed_builder_gate.py (+ --clean-checkout) and the CI step.

No change under ownlang/, rust/, spec/, the extractor or T0 calibration.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ZFvhLx1fM9Gerg4dKsZcL

Author: claude

.gitattributes

@@ -23,3 +23,10 @@
 # hashed 79ad1476f219 on Linux and 3dda13ce16d6 on Windows, and a run that
 # measured exactly the right tree was rejected as evidence for another tree.
 docs/evidence/*.json text eol=lf
+
+# TB-MVP-01: the generated protocol surface is compared BY BYTE with what
+# `frontend/roslyn/Own.TypedBuilder` writes (`\n`, no BOM), and the Typed Builder
+# gate's evidence is the same bytes on every platform. A Windows checkout with
+# `core.autocrlf=true` would make a correct generator look stale.
+samples/OrderBackend/OrderBackend/Domain/Order.Protocol.cs text eol=lf
+samples/OrderBackend/evidence/* text eol=lf

.github/workflows/ci.yml

@@ -3353,6 +3353,16 @@ jobs:
       # no exit code and no stderr — over every protocol case and refusal and examples/.
       - name: Heap-effect sidecar (samples + inertness of --heap-effects)
         run: python scripts/heap_effects_gate.py
+      # TB-MVP-01 (docs/notes/tb-mvp-01-preregistration.md): the Typed Builder Order
+      # vertical slice. The generator's output is deterministic and committed; the corpus
+      # is held to its registered compiler / extractor / core answers; the backend runs
+      # real HTTP against real SQLite twice with oracles outside the typed API.
+      - name: Typed Builder MVP (generator, corpus, EF + HTTP acceptance)
+        if: matrix.os != 'ubuntu-latest'
+        run: python scripts/typed_builder_gate.py
+      - name: Typed Builder MVP + both public CLIs on every core-stage document
+        if: matrix.os == 'ubuntu-latest'
+        run: python scripts/typed_builder_gate.py --rust "$PWD/rust/target/debug/own-cli"
 
   # P-012 slice 1: score the checker against the labeled corpus on REAL C# — not
   # just the .own reduction tests/test_corpus.py checks. Per case: the bug must be

frontend/roslyn/Own.TypedBuilder/Own.TypedBuilder.csproj

@@ -0,0 +1,18 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net8.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <AssemblyName>own-typed-builder</AssemblyName>
+    <RootNamespace>Own.TypedBuilder</RootNamespace>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <!-- Syntax only: the generator parses one declaration file, it never builds a
+         compilation. Same Roslyn as the extractor, so one restore serves both. -->
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.9.2" />
+  </ItemGroup>
+
+</Project>

frontend/roslyn/Own.TypedBuilder/Program.cs

@@ -114,6 +114,11 @@ API, EF Core, SQLite — is in
 [`protocol-samples/efcore`](protocol-samples/efcore), and
 `python scripts/protocol_gate.py` ties every committed fact back to the C# it came
 from.
+The product-shaped version of the same backend, with the protocol **generated**
+from one annotated declaration (`frontend/roslyn/Own.TypedBuilder`), a typed
+builder, and every transition over HTTP, is
+[`samples/OrderBackend`](../../samples/OrderBackend) (TB-MVP-01,
+`python scripts/typed_builder_gate.py`).
 
 **What is claimed.** The profile protects the local C# capabilities and aliases of
 an entity that already exists. It does **not** protect the persisted row from

frontend/roslyn/README.md

@@ -0,0 +1,2 @@
+bin/
+obj/

samples/OrderBackend/.gitignore

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net8.0</TargetFramework>
+    <LangVersion>12</LangVersion>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RootNamespace>OrderBackend.Acceptance</RootNamespace>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\OrderBackend\OrderBackend.csproj" />
+  </ItemGroup>
+
+</Project>

samples/OrderBackend/Acceptance/Acceptance.csproj

@@ -0,0 +1,24 @@
+using Microsoft.EntityFrameworkCore;
+using OrderBackend.Domain;
+
+namespace OrderBackend.Data;
+
+/// A plain DbContext: no custom base, no repository, no interceptor, no query provider.
+public sealed class OrdersDb(DbContextOptions<OrdersDb> options) : DbContext(options)
+{
+    public DbSet<Order> Orders => Set<Order>();
+
+    protected override void OnModelCreating(ModelBuilder modelBuilder)
+    {
+        modelBuilder.Entity<Order>(order =>
+        {
+            order.HasKey(o => o.Id);
+            order.Property(o => o.Customer).IsRequired();
+            // the exact member name, strictly: an unknown stored value is an exception at
+            // materialization, never a state (OrderStatusStorage is generated)
+            order.Property(o => o.Status).HasConversion(
+                state => OrderStatusStorage.ToStore(state),
+                raw => OrderStatusStorage.FromStore(raw));
+        });
+    }
+}

samples/OrderBackend/Acceptance/Program.cs

@@ -0,0 +1,223 @@
+// Generated by Own.TypedBuilder from Order.cs. Do not edit: change Order.cs and regenerate.
+//
+// The state protocol of Order: one [ProtocolToken] per state, one transition per
+// [Transition], one [ProtocolRegion] per state with a way out, the checked refinement,
+// the strict storage of the state, and the staged builder. Own.NET analyses this file as
+// source: it is the protocol's trusted definition surface.
+
+using System;
+
+namespace OrderBackend.Domain;
+
+partial class Order
+{
+    // Draft -> Submit -> Submitted
+    internal void ApplySubmit(DateTime at)
+    {
+        OnSubmit(at);
+        Status = OrderStatus.Submitted;
+    }
+
+    // Submitted -> Approve -> Approved
+    internal void ApplyApprove(DateTime at)
+    {
+        OnApprove(at);
+        Status = OrderStatus.Approved;
+    }
+
+    // Approved -> Ship -> Shipped
+    internal void ApplyShip(DateTime at, int trackingNumber)
+    {
+        OnShip(at, trackingNumber);
+        Status = OrderStatus.Shipped;
+    }
+
+    /// Starts a new Order in its initial state, Draft. Build() exists only once every
+    /// required field was given.
+    public static DraftBuilder.CustomerStep Create() => new();
+
+    public sealed class DraftBuilder
+    {
+        private readonly string _customer;
+
+        private DraftBuilder(string customer)
+        {
+            _customer = customer;
+        }
+
+        public Order Build() => new() { Customer = _customer, Status = OrderStatus.Draft };
+
+        public sealed class CustomerStep
+        {
+            internal CustomerStep()
+            {
+            }
+
+            public DraftBuilder Customer(string customer)
+            {
+                ArgumentNullException.ThrowIfNull(customer);
+                return new DraftBuilder(customer);
+            }
+        }
+    }
+}
+
+/// The runtime half of the refinement: the state came from data, so it is checked once,
+/// at the region entry.
+public sealed class InvalidOrderStateException(int id, OrderStatus actual, OrderStatus required)
+    : InvalidOperationException($"order {id} is {actual}, not {required}")
+{
+    public int Id { get; } = id;
+
+    public OrderStatus Actual { get; } = actual;
+
+    public OrderStatus Required { get; } = required;
+}
+
+/// A persisted state that is not exactly one of OrderStatus's names. Never mapped to a
+/// state: no default, no case folding, no number.
+public sealed class CorruptOrderStateException(string raw)
+    : InvalidOperationException($"the persisted order state '{raw}' is not an OrderStatus")
+{
+    public string Raw { get; } = raw;
+}
+
+/// The one mapping between OrderStatus and its stored text: the exact member name.
+public static class OrderStatusStorage
+{
+    public static string ToStore(OrderStatus state) => state switch
+    {
+        OrderStatus.Draft => "Draft",
+        OrderStatus.Submitted => "Submitted",
+        OrderStatus.Approved => "Approved",
+        OrderStatus.Shipped => "Shipped",
+        _ => throw new CorruptOrderStateException(state.ToString()),
+    };
+
+    public static OrderStatus FromStore(string raw) =>
+        TryFromStore(raw, out var state) ? state : throw new CorruptOrderStateException(raw);
+
+    public static bool TryFromStore(string? raw, out OrderStatus state)
+    {
+        switch (raw)
+        {
+            case "Draft":
+                state = OrderStatus.Draft;
+                return true;
+            case "Submitted":
+                state = OrderStatus.Submitted;
+                return true;
+            case "Approved":
+                state = OrderStatus.Approved;
+                return true;
+            case "Shipped":
+                state = OrderStatus.Shipped;
+                return true;
+            default:
+                state = default;
+                return false;
+        }
+    }
+}
+
+/// Order in state Draft. A transition spends this token and hands back the next one.
+[ProtocolToken]
+public readonly ref struct DraftOrder
+{
+    private readonly Order _order;
+
+    internal DraftOrder(Order order) => _order = order;
+
+    public int Id => _order.Id;
+
+    public SubmittedOrder Submit(DateTime at)
+    {
+        _order.ApplySubmit(at);
+        return new SubmittedOrder(_order);
+    }
+}
+
+/// Order in state Submitted. A transition spends this token and hands back the next one.
+[ProtocolToken]
+public readonly ref struct SubmittedOrder
+{
+    private readonly Order _order;
+
+    internal SubmittedOrder(Order order) => _order = order;
+
+    public int Id => _order.Id;
+
+    public ApprovedOrder Approve(DateTime at)
+    {
+        _order.ApplyApprove(at);
+        return new ApprovedOrder(_order);
+    }
+}
+
+/// Order in state Approved. A transition spends this token and hands back the next one.
+[ProtocolToken]
+public readonly ref struct ApprovedOrder
+{
+    private readonly Order _order;
+
+    internal ApprovedOrder(Order order) => _order = order;
+
+    public int Id => _order.Id;
+
+    public ShippedOrder Ship(DateTime at, int trackingNumber)
+    {
+        _order.ApplyShip(at, trackingNumber);
+        return new ShippedOrder(_order);
+    }
+}
+
+/// Order in state Shipped. Terminal: no transition leaves it.
+[ProtocolToken]
+public readonly ref struct ShippedOrder
+{
+    private readonly Order _order;
+
+    internal ShippedOrder(Order order) => _order = order;
+
+    public int Id => _order.Id;
+}
+
+public delegate void DraftRegion(DraftOrder draft);
+public delegate void SubmittedRegion(SubmittedOrder submitted);
+public delegate void ApprovedRegion(ApprovedOrder approved);
+
+/// The checked refinement: an Order whose state is only known at run time becomes a token
+/// inside the callback, or the call throws and no token exists. A state no transition
+/// leaves has no region: its token could never be spent.
+public static class OrderProtocol
+{
+    [ProtocolRegion]
+    public static void WithDraft(Order order, DraftRegion body)
+    {
+        ArgumentNullException.ThrowIfNull(order);
+        ArgumentNullException.ThrowIfNull(body);
+        if (order.Status != OrderStatus.Draft)
+            throw new InvalidOrderStateException(order.Id, order.Status, OrderStatus.Draft);
+        body(new DraftOrder(order));
+    }
+
+    [ProtocolRegion]
+    public static void WithSubmitted(Order order, SubmittedRegion body)
+    {
+        ArgumentNullException.ThrowIfNull(order);
+        ArgumentNullException.ThrowIfNull(body);
+        if (order.Status != OrderStatus.Submitted)
+            throw new InvalidOrderStateException(order.Id, order.Status, OrderStatus.Submitted);
+        body(new SubmittedOrder(order));
+    }
+
+    [ProtocolRegion]
+    public static void WithApproved(Order order, ApprovedRegion body)
+    {
+        ArgumentNullException.ThrowIfNull(order);
+        ArgumentNullException.ThrowIfNull(body);
+        if (order.Status != OrderStatus.Approved)
+            throw new InvalidOrderStateException(order.Id, order.Status, OrderStatus.Approved);
+        body(new ApprovedOrder(order));
+    }
+}