# System IDL

System IDL is the bounded, non-executable semantic language inside `.one`.
It declares stable meaning and governed intent across a complete system.

## What it can describe

Semantic domains can define closed declaration vocabularies for:

- schemas, contracts, operations, faults, effects, and capabilities;
- components, services, jobs, workflows, data, and communication;
- experiences, policy, composition, providers, infrastructure, and deployment;
- custom organization or industry semantics.

The universal structural kernel supports identities, namespaces, products,
variants, bounded collections, quantities, dependencies, directional mappings,
source locations, proofs, and provenance.

## What it cannot do

System IDL has no user functions, arbitrary loops, mutable variables, async
execution, macros, reflection, ambient file or network access, clock, entropy,
process access, secret resolution, or provider calls.

A semantic domain can define a bounded declarative expression or rule tree. It
cannot add tokens, operators, precedence, macros, or executable constructs to
System IDL.

## Meaning comes from the selected domain

Each semantic document selects one exact primary semantic-domain package and
namespace. The domain owns its vocabulary, schemas, invariants, defaults,
compatibility, and normalization rules. The namespace authority owns the
authored declaration identities and values under those rules.

`use` makes external identities referenceable. It does not merge vocabularies,
activate optional packages, select providers, or grant authority.

## Frontends converge before trust

Standalone semantic sections, inline Rust `one!`, generated Rust declaration
SDKs, and admitted imported models all produce an untrusted
`DeclarationBundle`. Owner validation and Knowledge admission construct
trusted D-IR and S-IR.

No frontend can mint trusted IR, choose a provider, issue a grant, or establish
realization.

## Lossless syntax is not semantic authority

The owned `logos` lexer and bounded parser produce one lossless Rowan tree for
valid, incomplete, and malformed source. Strict acceptance is a separate
bounded check.

Syntax nodes, source ranges, structural matches, and editor indexes can locate
bytes and propose reviewable patches. They cannot infer declaration intent,
identity, compatibility, implementation binding, requirement impact, or
authority.

Canonical owners:
[System IDL](https://github.com/muijf/one/blob/main/systems/system-idl/AGENTS.md)
and
[Contracts](https://github.com/muijf/one/blob/main/systems/contracts/AGENTS.md).