Clojure REPL interface to checked Lean project execution. Core Ansatz can be
used alongside this optional module; kernel declaration import is separate.

Pure host planning for scalar-free managed arguments; no guest allocation or RC operation.

Bounded portable native-project artifacts. Reading requires an independent
expected manifest digest and performs no native/toolchain discovery.

Audited positive task-free profile. Descriptors are metadata, not artifact authority.

Type-directed host carriers. Leaf conversion allocates no guest Nodes and
can finish before crossing the interpreter's invocation boundary.

Explicit external Linux producer bundle. SDK pins independently authorize its
helpers; bundle self-description alone never authenticates native producers.

Bounded exact UTF-8 and JSON parsing shared by the native source producer.

Actual native build receipt issuer. Definition load does not launch processes.
Load once: issued receipt identities survive only in this namespace cohort.

Internal source/compiled-module preparation. No artifact, entry or READY
Project is issued here. Uses the fixed compiler's monitored native transport.

Shared bounded native producer transport. Loaded only by explicit source
compilation; precompiled artifact loading does not initialize this service.

Private materialization of a fully validated host plan in one actual engine.
The caller must journal returned roots and start under the same Project lease.

Shared native entry observations. Validating metadata never issues a build,
artifact or runtime capability; those issuers retain their own byte custody.

Internal adapter for the packaged canonical Java interpreter. These wrappers
prepare trusted original rows and drive its existing ownership protocol; they
do not authenticate source bytes, infer Lean types or establish Init startup.
No research interpreter, benchmark, runtime javac or source checkout is used.

Original occurrence-metadata and body-call Header borrowing checks.

Trusted native source→portable artifact preparation. Never opens a JVM Project
or invokes its runtime initializers/main; native compilation can execute metaprograms.

Pure independently admitted non-entry producer cohorts. Never loads native services.

Private issued Project leases behind the Java facade. No raw guest values,
native producer receipts or mutable engine aliases cross that facade.

Combined program publisher over actual native build receipts. No process launch.

Trusted scalar/buffer codec helpers. Plans contain no guest Nodes. Borrowed
decoders acquire/release no credits; the caller retains the actual result root.

Conservative pre-admission proof for sharing diagnostics on managed values.
Authenticated startup rows/entries are inputs, never caller certificates.

Closed application signatures shared by native evidence, artifact validation
and host codecs. These are calling descriptors, not inferred erased IR types.

Interpreted startup ledger; only the fixed research publisher currently issues Prepared.

Borrowed, type-directed result decoding. No guest allocation or RC operation.
The caller keeps the actual owned result root until decoding completes.