P-022 step 6b: implement Rust own-bridge with layered OwnIR parity

[PhysShell]

Parent: #250
Recommended tier: strong
Blocked by: #258
Preferably after: #255 and #256

Goal

Implement rust/crates/own-bridge as the production OwnIR-to-core boundary, following the normative contract from #258 and preserving Python behavior exactly.

The bridge consumes OwnIR facts, validates and lowers them into the Rust core, performs interprocedural MOS inference, drives own-analysis, and maps correct analysis results into the common diagnostic model.

Production dependencies

The crate may depend on:

own-ir
own-syntax
own-cfg
own-analysis
own-diagnostics

It must not create cycles or move presentation/analysis logic into the bridge.

Checkpoint 1: typed OwnIR validation

Implement:

• serde types for the current schema;
• version checks;
• additive optional-field handling;
• unknown vocabulary failure rules;
• reference/location validation;
• deterministic loading;
• safe errors for untrusted input.

Acceptance

• all valid Python fixtures accepted;
• all invalid controls rejected with matching error class/category;
• no panic on malformed JSON/OwnIR;
• limits or defensive parsing documented for externally supplied inputs.

Checkpoint 2: fact lowering

Implement:

• OwnIR functions/types/resources;
• handle/RID minting;
• facts → AST/CFG;
• local map and kill-on-rebind;
• branches, loops and merge preparation;
• source-location preservation;
• normalized lowered representation for differential testing.

Acceptance

• Python-authored lowering fixture matches exactly/canonically;
• ordering and ID permutations that are non-semantic do not alter output;
• no analysis algorithm appears in the bridge.

Checkpoint 3: interprocedural MOS

Implement the #258 contract for:

• Fresh/Borrow/Consume/Forward;
• mixed and unknown summaries;
• return skeletons and parameter effects;
• overload sig resolution and fallback;
• canonical names;
• recursion/cycles;
• BCL fresh-factory knowledge;
• first-party/external behavior.

Acceptance

• every mapped Python MOS test family has a frozen differential control;
• generated call-graph controls cover cycles, overloads and fallback;
• unknown behavior remains conservative;
• output is deterministic.

Checkpoint 4: analysis wiring

Feed real bridge facts into:

• ownership;
• lifetime;
• buffer policy;
• effect;
• DI.

The bridge must preserve analysis-selected primary anchors. It must not duplicate effect or DI graph algorithms.

Required controls

• EFF001 through real OwnIR facts;
• DI001–DI005 through real OwnIR facts;
• DI004 call-site anchor;
• DI005 cache-site anchor;
• duplicate-site last-wins;
• multi-file ordering;
• ownership/lifetime cases already pinned by .own parity where representable through OwnIR.

Checkpoint 5: full fact-to-verdict parity

Compare normalized:

path
line
code
severity
message
subject
resource_kind
ordered Evidence

After #256, also compare canonical report JSON and SARIF.

Fixture layers

1. validation acceptance/rejection;
2. normalized lowered representation;
3. MOS summaries;
4. final diagnostics;
5. report/SARIF where available.

All fixtures are Python-authored. Rust steady-state tests invoke zero Python.

Guardrails

• No schema redesign.
• No new diagnostic behavior.
• No bridge-side repair of wrong analysis locations/codes.
• No duplication of ownership/lifetime/effect/DI algorithms.
• No CLI cutover.
• No performance pass before parity and profiling.
• Python remains authoritative.

PR/checkpoint packet

Each checkpoint reports:

Python-only:
Rust-only:
Changed:
Ordering-only:
Unexplained:
Fixture changed:
Acceptance changed:
Production DAG changed:

Unexplained must be zero before proceeding.

Final acceptance

• own-bridge exists in the workspace with the allowed DAG.
• Validation, lowering, MOS, analysis wiring and final verdict parity are green.
• Full current OwnIR test-family inventory from P-022 step 6a: formalize OwnIR bridge semantics before the Rust port #258 is covered.
• Rust bridge handles malformed input without panic.
• No Python behavior or fixture acceptance is weakened.
• Workspace and Python CI gates are green.
• The result is ready to power dual-engine shadow mode, but Python remains the public default.