fix(#257): mandatory authoritative wasm-validation backstop — loom cannot emit invalid output

[avrabe]

Fixes #257. Makes v1.1.18's reactive #254/#255 fix systemic: turns loom's 'never emits invalid wasm' promise from 'we fixed the two passes gale found' into a guarantee by construction.

Mandatory final gate (loom-core/src/lib.rs, optimize_module)

• Snapshot the ORIGINAL parsed module up front (after the v1.1.11 element remap scrambles the function-pointer table — valid-but-wrong code, falcon SIL gate fails (0.13m → 593.8m) #196 element-skip guard).
• After the full pass pipeline + strip_debug_sections (the exact bytes the CLI emits), encode and run the authoritative wasmparser::validate. On rejection/encode-failure: revert the entire optimization to the original, record_revert("optimize_module:structural-invalid"), and print a loud diagnostic. Worst case = unoptimized-but-VALID output; never invalid. (Per-pass bisection noted as a follow-up refinement — not needed for the guarantee, since each pass already reverts its own invalid transforms.)

Hardened the lenient siblings (#256 per-pass pattern)

• constant_folding and simplify_locals used translator.verify(), whose SKIPPED-proof path (float load/store, or the LOOM_Z3_MAX_INSTRUCTIONS size threshold) returned Ok(()) and kept the transform UNCHECKED — the exact loom optimize emits INVALID wasm (stack underflow) via the inline pass — verification skipped for float load/store functions, not reverted #254 bug class. Added a per-pass functions snapshot + encode + wasmparser::validate, reverting the whole pass on rejection.
• Other passes already use verify_or_revert_strict (skip = failure) or are covered by the final gate. No VALID transform weakened.

Tests (4, loom-core)

• Final gate keeps the loom optimize emits INVALID wasm (stack underflow) via the inline pass — verification skipped for float load/store functions, not reverted #254 fixture valid; no-op on clean repro-219/sem + a clean hand-written module (no spurious reverts); and the detect+revert primitive — an intra-block stack-underflow module that loom's shallow validator misses is REJECTED by wasmparser::validate, and reverting yields valid wasm.

Checks

cargo test --release --workspace green (loom-core 427). fmt + clippy clean.

Part of v1.2.0 (with #240 / #259). 🤖 Generated with Claude Code

[temper-pulseengine]

Automated review for PR #260

pulseengine/loom:fix/257-mandatory-output-validation → pulseengine/loom:main

Verdict: 🔴 Request changes

Summary: Fixes #257 by adding a final gate to ensure loom's 'never emits invalid wasm' promise.

Findings: 7 mechanical (rivet) · 0 from local AI model.

Findings (7):

1. 🟡 6 artifacts (rivet-validate)
   field 'evidence-type' has value 'test', allowed: ["test-report", "analysis", "simulation", "review", "field-data", "formal-proof"] — affecting: SOL-4, SOL-3, SOL-8, SOL-5, SOL-6, SOL-7

2. 🟡 6 artifacts (rivet-validate)
   field 'goal-type' has value 'top-level', allowed: ["system-level", "element-level", "operational", "derived"] — affecting: SG-3, SG-1, SG-6, SG-4, SG-5, SG-2

3. 🔴 6 artifacts (rivet-validate)
   Every safety goal must be supported by evidence (solution) or decomposed into sub-goals (via strategy), unless marked undeveloped
   — affecting: SG-1, SG-2, SG-3, SG-4, SG-5, SG-6

4. 🟡 6 artifacts (rivet-validate)
   Top-level safety goals should have context defining scope and assumptions — affecting: SG-1, SG-2, SG-3, SG-4, SG-5, SG-6

5. 🟡 6 artifacts (rivet-validate)
   STPA losses should be addressed by safety goals in the safety case — affecting: L-1, L-2, L-3, L-4, L-5, L-6

6. 🔴 3 artifacts (rivet-validate)
   link type 'acted-on-by' is not defined in the schema — declare it in link-types: or remove the link — affecting: CP-1, CP-3, CP-2

7. 🟡 16 artifacts (rivet-validate)
   conditional rule 'approved-needs-description': field 'description' is required when condition is met — affecting: SC-CTXT-5, SOL-7, SOL-6, SC-CTXT-1, SG-3, SOL-8, SG-1, SG-6, SG-5, SS-1 (+6 more)

---

Generated by a local AI model and post-validated against a strict JSON contract. Each finding includes the verbatim line being criticised — verify by reading the file at the cited location.

Reviewed at 1587192