spec: async-over-WasmGC convergence ABI + ADR-005 (Ephapax review, #31)

[hyperpolymath]

Records the shared async-over-WasmGC boundary protocol — surfaced by AffineScript #225 / ADR-013 and tracked by typed-wasm#31 — as a convergence-ABI spec section, plus the Ephapax co-stakeholder review.

What this adds

• spec/async-convergence-abi.adoc — the agreed protocol: Thenable handle (synchronous i32 return), thenableThen(handle, closure) continuation in the shared closure ABI [fnId/table_idx@0, envPtr@4] via the module indirect-call table, host re-entry on settle, thenableResultJson / fixed-shape typed reader, { "__error" } host-boundary reject envelope, once-settle guarantee, and composition up the call chain (the basis of AffineScript ADR-013's transparent CPS surface, no JSPI).
• ADR-005 in .machine_readable/6a2/META.a2ml (status: proposed).
• Cross-reference from AGGREGATE-LIBRARY-VISION.adoc.

Ephapax convergence review (the typed-wasm#31 asks)

• Co-stakeholder review of the protocol — reviewed against ephapax-wasm lowering + effect system (ADR-007..ADR-010).
• Recorded as a typed-wasm convergence-ABI spec section — spec/async-convergence-abi.adoc + ADR-005.
• Divergence vs Ephapax's async lowering — NONE. Ephapax has no async lowering yet (perform/handle emit unreachable), so adoption is purely additive. Its closure cell [table_idx@0, env_ptr@4] / call_indirect (env_ptr,param)->i32 is byte-identical to AffineScript #199. Planned one-shot resume(once) aligns with the once-settle guarantee. The {__error} envelope is a host-boundary convention and does not constrain Ephapax's native sum-type error model.

Status / not closing #31

Refs #31, not Closes — #31 is the co-stakeholder review issue. ADR-005 is proposed; on explicit joint sign-off it becomes accepted and AffineScript #225 PR 2–4 (the CPS transform proper) are unblocked. Does not couple AffineScript to typed-wasm nor constrain Ephapax — binary-level convention only.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 25 issues detected

Severity	Count
🔴 Critical	6
🟠 High	8
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/setup-node@v4 needs attention",
    "type": "unpinned_action",
    "file": "e2e.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/setup-node@v4 needs attention",
    "type": "unpinned_action",
    "file": "e2e.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/upload-artifact@v4 needs attention",
    "type": "unpinned_action",
    "file": "release.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/download-artifact@v4 needs attention",
    "type": "unpinned_action",
    "file": "release.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/SessionProtocol.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "assert_total bypasses totality checker (1 occurrences, CWE-704)",
    "type": "assert_total",
    "file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/SessionProtocol.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/Echo.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence