PowerShell Compilation Architecture Roadmap

Last updated: 2026-10-03

This roadmap is the execution plan for growing PowerForge PowerShell compilation without turning the analyzer, transpiler, command handling, or C# emitter into increasingly coupled catch-all components.

The default branch contains a typed semantic compiler core with immutable bound IR, deterministic analysis and lowering, a lowered-only C# method backend, generated-project publication, help/module-contract flow, consumed dependency locks, typed command-family contracts, runtime-free provider injection, and canonical hosted lifecycle binding. Compiler-selected payloads remain authoritative through delivery, reusable checkpoints authenticate the compiler and normalized release plan, and artifacts carry decision and reproduction evidence. Completed architecture checkpoints do not imply semantic completeness: the continuation branch contains the assignment-constraint correction, net8 target retirement, statement-count-independent multi-region selection, structured collection transfer, return/cardinality families, one bounded local-call collection-factory closure, host-bound computed-member access, and complete Hybrid-native multi-stage pipelines whose streams, lifecycle, and retained collection mutation remain owned by the active PowerShell invocation. Broad workload coverage remains the principal product gap.

The companion PowerShell Compilation guide documents current behavior, artifact modes, supported syntax, measured performance, census evidence, and distribution limits. This file records completed architecture gates as well as the remaining implementation plan.

This roadmap does not schedule a package, gallery, NuGet, or GitHub release. Those remain separate decisions after source work is complete.

The next major milestones, 24–31, define the delivery tranche: values/collections, complete pipelines, stateful modules, practical CLR libraries, the development loop, broader complete-workload coverage, ordinary command forms, distribution/platform qualification, and measured acceleration. M24–M29 have completed bounded local gates. M29a now addresses common authored forms that still fall back before M30 distribution work. Interactive source debugging is a deferred developer-tooling qualification, not a gate on compiler coverage. The architecture history below remains their foundation.

Product north star

The current implementation priority is correctness, preservation of authored behavior, and useful workload coverage. New support must preserve the program's parameter binding, values and types, output shape, scope, ordering, errors, and continuation behavior on its supported hosts. Select reusable contracts that unlock real scripts and modules; do not choose work primarily because a small helper is easy to accelerate. Runtime retention is an explicit compatibility outcome, not compiled-coverage credit. Speedups and boundary-amortization targets belong to a later optimization phase and are not acceptance gates for new semantic support. Existing benchmark results remain evidence about their measured workloads.

PowerForge should offer four honest outcomes from one compiler front end:

Package arbitrary compatible source with a PowerShell runtime when semantic compilation is not required.
Hybrid compile proven regions and retain explicit PowerShell-backed behavior for the rest.
Strict managed produce a runtime-free CLR DLL or EXE whose accepted behavior lowers to ordinary typed .NET code.
Strict native publish the same runtime-free program with NativeAOT for a specific operating system and architecture.

“Python territory” means reaching the same practical product territory available to a mature scripting ecosystem: keep a source-first authoring experience, package broad dynamic programs, accelerate eligible hot regions, expose typed library APIs, and produce self-contained native executables when the complete program fits a stricter contract. It does not mean claiming that arbitrary dynamic PowerShell can become native code without a PowerShell runtime.

Compiler breadth alone is not enough. Practical maturity also requires a versioned semantic compatibility profile, a reproducible project/lock/restore experience, platform-qualified package variants, a public provider ecosystem, clean-environment execution, and profiling that tells users where compilation helps. Milestones 18–22 make those product expectations explicit rather than treating one emitted-function percentage as the destination.

For this roadmap, native-like means all of the following:

accepted Strict code does not load System.Management.Automation, start pwsh, or carry an embedded script fallback;
bound operations lower to direct CLR operations or a small runtime-free support library, not to string evaluation or dynamic PowerShell dispatch;
generated C# is readable, deterministic, source-mapped, and available as a diagnostic artifact before considering direct IL emission;
eligible compute approaches the throughput and allocation profile of equivalent generated or hand-written C#;
NativeAOT is a deployment backend for an already runtime-free program, not a way to hide unsupported PowerShell semantics;
unsupported behavior is diagnosed precisely in Analyze/Hybrid and rejects Strict compilation.

The product succeeds when users can predict which of these outcomes they are getting and why. File extensions alone are not evidence of compilation.

Status legend

[x] complete and proven by current source or executable evidence
[ ] required work
Partial means useful implementation exists but the milestone exit gate is not yet satisfied
Blocked means the milestone must not receive breadth work until an earlier gate closes
Current identifies the milestone that should receive implementation effort now
A milestone is complete only when its exit gate is satisfied

Current position

Development continuation: feature/powershell-compiler. On October 3 it incorporates origin/main at daba966bace70b35cac14088f5c5d8b91e893225, including the PowerShell 7.6.6 host/SDK servicing update. The continuation remains separate from the default branch; candidate CI/review, full qualification, and distribution remain M30 work. The recommended next two deliveries close M29a's current qualification gate, then establish a bounded M30 distribution baseline.

M24–M28 have completed bounded value, pipeline, state, region, local-feed consumption, and source-first development-loop gates. M28 includes executable run/watch through the existing project and cache owners, Strict library NuGet packaging through the independent-rebuild packer, grouped project diagnostics from canonical decisions and bound local calls, and a Hybrid module consumer quickstart on both supported Windows PowerShell hosts. Failed rebuilds do not execute stale artifacts, and launch rechecks this attempt's authenticated output inventory. Source paths/PDBs and debug-plan are implemented, but interactive debugger behavior is unqualified. M29 subsequently completed its pinned local portfolio gate with 30 newly emitted and differentially executed module functions, three module workflows, and an offline standalone workflow; this is not general language coverage. M29a prioritizes everyday command shapes using fresh blocker and complete-workflow evidence. The assessment identifies revisions, findings, and executable evidence; the next milestones own the active checklist.

The September 20 checkpoint recorded 1,063 compiler tests and six Strict Windows programs passing, with 188/282 complete emitted PSSharedGoods functions and 36 promoted regions. These are dated, packet-specific results. An emitted Hybrid function can still delegate operations to PowerShell; counters alone prove neither runtime-free execution nor performance. Earlier 7.4/net8 and heterogeneous-discovery results below retain their historical scope.

Generated-artifact policy permits net472 and net10.0 libraries/modules and only net10.0 executables. Hosted qualification targets Windows PowerShell 5.1 and PowerShell 7.6. The shared PowerForge.PowerShell library independently retains net472;net8.0;net10.0 build targets for its consumers. Compiler artifact retirement must not be described as removal of that shared host-library target.

Keep four evidence states separate: implementation in this continuation; integrated source and CI; packed/published/installed versions; and execution on the declared target. M30 owns release and host-servicing qualification. No historical checkbox substitutes for those gates.

Recorded corrective gate: assignment semantics (September 7)

The merged 2026-09-06 corrections cover Single arithmetic, constrained numeric updates, integral remainder, artifact-aware census, resilient input assessment, and the bounded compiler gate. Their six-program Strict packet remains the acceptance baseline. See the assessment for the historical execution evidence.

Reproduce RHS casts being misclassified as persistent local constraints through original/generated PowerShell 5.1 and 7 execution.
Infer cast-initialized locals without inventing a variable constraint; retain/reject unsupported dynamic numeric promotion and preserve null-string reassignment.
Preserve actual LHS constraints, ordinary unchanged casts, and current external census acceptance. Local validation passes 285 compiler gate cases, six Strict programs, 16 focused closure cases, and all three compiler framework builds.
Complete one independent read-only semantic review. Record conservative scalar-string foreach eligibility loss as a remaining bounded-coverage gap rather than relaxing the fix.
Integrate the audited correction through normal source review and CI before treating it as a merged fix. Public package qualification remains M21/M30 work.

Corpus expansion and pilot order

Add a separate immutable discovery packet for heterogeneous scripts, a real module, standalone administration scripts, and a computation family. Each Strict/Hybrid scan assessed 277/290 inputs and retained all 13 source-closure failures. External sources were neither imported nor executed.
Minimize repeated remaining lifecycle, pipeline, scope, and object/collection blockers using complete-workflow unlocks and co-blockers.
Qualify promoted regions in real commands from at least two unrelated families, with original/generated state, stream, error, cleanup, and crossing-cost evidence.
Qualify the complete unchanged LSA detection script as a Hybrid EXE on a controlled Windows target in its enabled state; source and executable output/exit matched and registry state was unchanged. Disabled, absent-value, and failure paths remain unqualified.

Start narrow internal pilots only for specifically qualified workflows. Public-feed lifecycle proof, disposable-target reboot/reconnect, and additional physical platforms remain separate release/provider/target gates.

The compiler already provides:

The companion guide owns the exact current benchmark numbers and runtime proof. This roadmap must not copy those figures as timeless claims; every performance or platform promotion uses a fresh clean-worktree run pinned to a source revision, toolchain, target framework, runtime identifier, and benchmark run ID.

The lowered C# method backend does not reference SMA AST types, and the former direct AST-to-C# emitter was deleted. Eligibility, call graphs, executable binding, source mapping, command providers, dependency locks, and hosted lifecycle metadata now consume canonical semantic or lowered contracts.

The dependency-ordered semantic pipeline migration checkpoint and bounded Milestones 6 and 9–15 are Complete after the latest review defects were reproduced and fixed at their canonical owners. Milestone 14 closes for its deliberately narrow supported set and for the generic Build-Module delivery contract: Strict net10.0 framework-dependent and NativeAOT executables on win-x64 and linux-x64 are supported, while other named RIDs and deployment profiles remain experimental rather than weakening that gate. Milestone 15 closes with three immutable IR rewrites, five backend-lowering/source-evidence optimization families, clean-candidate performance evidence, and measured Hybrid boundary cost. Milestone 17 is Complete with semantic fingerprints, portable failure mapping, optional semantic-only IR snapshots, deterministic diagnostic audit evidence, and explicit retention/redaction policy.

The canonical compiler pipeline, semantic-profile/oracle architecture, and bounded provider-extensibility architecture are Complete within their documented profiles. The separately built provider SDK supplies canonical NuGet/signer-aware package identity, reviewed lock/provenance binding, metadata-only compiler discovery, and a versioned executable adapter ABI that runs through Strict managed, Strict NativeAOT, Hybrid, and binary-module artifacts without loading provider assemblies into the compiler. Semantic profiles affect target identity, compilation, providers, caches, artifacts, diagnostics, and compatible requirements. The oracle integrity-binds observations to exact executable/runtime identities, directly records ordered child-process launch/exit events on every promoted Windows host, and fails promotion on unpinned hosts or unexplained differences. Milestones 19–22 retain the broader ecosystem, useful-coverage, public-release, and platform gates. Milestone 23 is the current semantic-growth gate: it must improve module-scale coverage through the same IR and live state owner, not by building another PowerShell runtime inside generated code.

Artifact ladder

The modes are different products with different guarantees. They must not be collapsed into a single “compiled” label.

Artifact	Current state	Requires PowerShell/SMA at runtime	Native/managed result	Primary value
Package EXE	Available	Yes, complete script	Managed host; optionally self-contained	Broad compatibility and delivery
Hybrid binary module	Available	Yes, only fallback and bounded hosted regions	Typed cmdlets plus retained script	Incremental acceleration inside PowerShell
Strict binary module	Available	Yes, as the cmdlet host; no script fallback	Managed DLL	Importable compiled PowerShell command surface
Strict CLR library	Candidate with clean-consumer proof, callable ABI schema 4 for static libraries and schema 5 for stateful libraries, and fail-closed managed-closure certification	No for a certified artifact	Managed DLL	Direct use from C# and other CLR hosts
Strict managed EXE	Supported for framework-dependent `net10.0` `win-x64` and `linux-x64`; portable managed builds retain their existing support state and other named profiles remain experimental	No for a certified artifact	JIT-compiled managed executable	Small runtime-free CLI/application
Strict NativeAOT EXE	Supported for `net10.0` `win-x64` and `linux-x64`; other profiles remain experimental and fail closed when their closure cannot be certified	No for a certified artifact	RID-specific native executable	No installed PowerShell or .NET requirement, low startup/footprint potential
Hybrid EXE	Managed foundation available; named-RID/native-host promotion remains experimental	Yes, explicit retained entry/dependency source and bounded hosted fallback	Packaged managed host plus registered typed cmdlets	Broad script compatibility with coarse compiled acceleration
Native shared library	Deferred	No	Platform ABI such as `.dll`, `.so`, or `.dylib`	Add only for a real non-.NET embedding consumer

A C# DLL means a managed CLR library with a documented .NET API. It is not a native shared library. Native shared-library export introduces a platform ABI, marshalling, lifetime, and error-contract product of its own and must not be implied by NativeAOT executable support.

Explicit target contract

Strict, Hybrid, and an artifact kind are not enough to describe semantic compatibility. Every successful artifact now carries one normalized, integrity-bound target contract with these dimensions:

PowerShell semantic profile, including the behavior family being targeted rather than only a target framework;
execution model: RuntimeFree, PowerShellHosted, or Mixed;
artifact model: executable, CLR library, or PowerShell binary module;
deployment model: framework-dependent, self-contained, trimmed, ReadyToRun experiment, or NativeAOT;
target framework and, when platform-specific, runtime identifier and architecture;
culture, encoding, filesystem, and operating-system assumptions that are compile-time facts versus runtime inputs;
allowed capabilities, including command regions, host streams, module hosting, managed/native dependencies, COM, filesystem/provider access, reflection, and dynamic invocation.

The modern runtime-free profile should default to the documented PowerShell 7-compatible contract already used by Strict execution. A net472 binary module executes inside Windows PowerShell 5.1 and is validated against that host. Where 5.1 and 7 differ, PowerForge either selects one named profile, emits a target-specific lowering, or rejects the construct. It must not claim one artifact is simultaneously identical to incompatible behaviors.

analyze, explain, and build accept the same --target-contract file and normalize it before dependency planning. Stored schema-v1 and schema-v2 contracts are authenticated against their declared support level before the current support policy is applied and schema-v2 identity is recomputed, so policy promotion or demotion does not invalidate an authentic stored request. NativeAOT dependency planning binds the exact runtime-pack version declared by the selected SDK; an unrelated newer ambient pack cannot change the reviewed graph.

PowerShell implementation as semantic evidence

PowerForge should study the official PowerShell source, especially LanguagePrimitives.cs, Compiler.cs, the runtime Binders.cs, and the upstream language tests. These are valuable evidence for conversion, truthiness, operators, parameter binding, pipeline enumeration, errors, and version-specific edge cases.

They are not a second implementation owner and must not become a hidden runtime dependency. The published Windows PowerShell 3.0 language specification is useful historical context but explicitly does not describe current PowerShell behavior. For each semantic feature, PowerForge therefore uses this evidence order:

define the intended PowerForge behavior for one named semantic profile;
record the relevant official documentation, pinned upstream source commit, and upstream test provenance;
implement the rule once in the PowerForge binder/IR/runtime-free support owner;
run black-box differential tests on the exact PowerShell 5.1 or PowerShell 7 host profile;
record any intentional, version-specific divergence instead of silently following whichever upstream source happens to be newest.

PowerForge may adapt small MIT-licensed upstream test cases with attribution and license tracking. It should not port PowerShell's expression compiler wholesale, call non-public engine internals from Strict artifacts, or make generated code depend on an installed PowerShell implementation. Upstream source is a semantic oracle and provenance input; the selected-host differential result is the compatibility proof.

End-state definition

PowerForge should compile every source region whose PowerShell-visible behavior can be proven for the selected target. It should use a bounded PowerShell command region when host execution is required and the boundary can be represented safely. It should retain truthful Hybrid fallback or reject Strict compilation when semantics cannot be proven.

The goal is not a second PowerShell runtime. Dynamic scope, arbitrary provider behavior, uninspectable command discovery, unrestricted ETS adaptation, and host-dependent behavior may legitimately remain runtime-backed.

The architecture is successful when:

parsing owns syntax;
binding owns semantic meaning;
analysis owns relationships and propagated facts;
lowering selects typed, hosted, or fallback execution;
backends render decisions already made;
reporting consumes the same semantic result instead of rediscovering eligibility;
adding a feature has one obvious owner;
adding a command family does not depend on registration or source order;
new semantic owners normally remain below 800 lines and no touched non-generated compiler source/test file exceeds the 1,000-line hard ceiling.

Non-negotiable design rules

One semantic owner

A conversion, operator, command, pipeline stage, runtime-state value, or parameter-binding rule is defined once. Analyzer, emitter, artifact builder, CLI, and census code must not carry parallel implementations.

No AST semantics in backends

PowerShell AST objects stop at parsing and binding. Backends may receive neutral source spans and an exact source slice for a bounded runtime region, but they do not inspect AST nodes to infer type, cardinality, effects, or support.

No emitter inference

An emitter may choose formatting and target-specific syntax. It may not infer local types, return types, output cardinality, command meaning, required host state, or fallback behavior.

Deterministic registration

Command and semantic handlers are selected by canonical identity and supported invocation shape. They are not tried in registration order. Duplicate registrations and ambiguous matches fail validation.

Delete migrated legacy paths

The transition is incremental, but not permanently dual-path. Every migrated semantic area removes its corresponding direct AST-to-C# path. New language features use the bound representation only.

Generic compiler behavior

External modules are regression workloads, not compiler design targets. Product names, command names, annotations, or module-specific workarounds do not become compiler intrinsics.

Artifact proof over internal proof

Unit tests protect pure semantic rules. Completion also requires generated artifact execution, PowerShell differential behavior, export/help verification where relevant, and census evidence.

Generated C# before direct IL

Readable C# remains the canonical executable lowering until evidence shows that Roslyn/MSBuild prevents a required semantic or performance result. Generated source, PDBs, sequence points, diagnostics, and independently rebuildable projects are product features. Direct IL is a later backend optimization, not an architectural shortcut around binding or lowering.

Runtime-free means runtime-free

Strict runtime-free artifacts must have a mechanically verified dependency closure with no System.Management.Automation, PowerShell SDK, embedded source fallback, pwsh child process, ScriptBlock, or string-evaluation path. A feature that needs any of these is hosted, Hybrid, or rejected.

NativeAOT is a backend constraint

NativeAOT does not expand the supported PowerShell language. It further restricts an already Strict program. Reflection, dynamic code generation, assembly discovery, serialization, globalization, native dependencies, and trimming behavior must be represented as capabilities and validated before AOT publication.

Source is data at compile time

Parsing, binding, census, and code generation do not execute the input program, import its modules for side effects, run profile scripts, or invoke discovered commands merely to infer their behavior. Optional external metadata acquisition is explicit, isolated, lockable, and recorded as a build input.

Dependency closure is explicit

Source eligibility and artifact completeness are separate decisions over the same graph. A compiled function is not ready when its required module, managed assembly, native asset, COM registration, format/type data, or runtime resource is unresolved. Every dependency has one deterministic identity, transitive closure, target capability, and artifact disposition.

Target pipeline

source discovery
      |
      v
PowerShell parser
      |
      v
semantic binder
      |
      v
immutable typed bound IR
      |
      v
analysis passes
  - type and conversion propagation
  - value state and output cardinality
  - control flow and definite assignment
  - function call graph
  - effects and mutation
  - capability requirements
  - fallback planning
      |
      v
lowering
  - typed CLR operations
  - generated cmdlet operations
  - bounded PowerShell regions
      |
      v
backends
  - C# source and source maps
  - Strict managed executable or CLR library
  - Strict NativeAOT executable
  - binary module or Hybrid host
  - diagnostics and census
      |
      v
artifact builder and atomic publication

Ownership boundaries

`PowerForge.PowerShell`

Owns PowerShell-specific behavior:

source parsing and AST adaptation;
semantic binding;
PowerShell type, conversion, truthiness, null, and enumeration rules;
parameter and advanced-function semantics;
pipeline and command semantics;
PowerShell module classification, static module metadata, host requirements, and module-to-command binding;
PowerShell-specific managed/native/COM capability boundaries;
runtime-state and host requirements;
bound IR, analysis passes, and PowerShell-specific lowering;
generated cmdlet and Hybrid boundary behavior.

`PowerForge`

Owns host-neutral behavior where it already fits the dependency direction:

stable public compilation plans and results;
artifact-neutral models;
host-neutral dependency/deployment graph, provenance, and artifact-disposition models;
build, filesystem, integrity, and artifact orchestration;
reporting models that do not require SMA types.

Do not move PowerShell semantics into PowerForge merely to make the IR look generic. The IR is an internal PowerShell compiler model, not a speculative general compiler framework.

Runtime-free support substrate

When the same emitted helper is needed by more than one backend, introduce one compiler-owned runtime-free support substrate, provisionally PowerForge.CompiledRuntime. Its shape is determined during the IR migration rather than copied into templates ad hoc.

It owns executable implementations of proven PowerShell-compatible primitives such as truthiness, scalarization, enumeration, comparison, conversion, numeric promotion, wildcard/regex behavior, stream records, and error shaping. It must:

have no dependency on SMA or a PowerShell host;
avoid unbounded dynamic, reflection emit, runtime compilation, and string evaluation;
be trim- and NativeAOT-safe with analyzer warnings treated as errors;
expose an internal, versioned ABI to generated artifacts;
multi-target only the CLR families required by real artifacts;
remain small enough that generated code still performs direct CLR operations for ordinary typed cases.

The binder remains the semantic owner. The support substrate implements decisions already present in bound/lowered nodes; it does not rediscover PowerShell meaning at runtime. Whether helpers are statically linked, source-included, or referenced as a package is an artifact decision, but all forms originate from the same implementation and version.

`PowerForge.Cli` and PSPublishModule

Remain thin surfaces:

parse user input;
map options to engine requests;
invoke the shared engine;
format results and diagnostics.

They do not decide eligibility, conversions, command semantics, artifact contents, or fallback behavior.

Bound IR contract

Every bound node has a stable node identity and carries:

a neutral source span: file, offsets, line, and column;
a PowerShell semantic type;
a CLR representation type when one is available;
null, missing, and no-output behavior;
scalar or collection cardinality;
observable effects;
required target capabilities;
execution disposition;
a stable fallback reason when typed behavior cannot be proven.

Type information

The type model must distinguish:

known CLR type;
collection and element type;
nullability and missing-value behavior;
PSObject or adapted-object representation;
statically known property shape;
required PowerShell conversion;
dynamic or unknown type with a reason.

System.Type alone is not the PowerShell type model.

Value state

The IR represents these states explicitly:

ordinary value;
$null;
AutomationNull.Value;
no pipeline output;
uninitialized or missing;
unknown.

Cardinality

The IR distinguishes:

no output;
exactly one scalar;
zero or one;
a fixed collection;
an enumerated pipeline stream;
zero or more;
unknown.

Effects

Effects are structured data, not an expanding group of unrelated booleans:

local, parameter, script, module, or global mutation;
success output;
verbose, warning, debug, information, error, or progress output;
host interaction;
runtime-state read or write;
external command dispatch;
provider or filesystem access;
terminating and nonterminating exception behavior;
dynamic invocation.

Execution disposition

Binding and fallback planning assign one of:

Typed;
PowerShellCommandRegion;
WholeFunctionFallback;
StrictRejected.

Each non-typed disposition includes a stable feature identifier, a precise explanation, its source span, and the causal semantic requirement.

Managed CLR ABI

A generated DLL needs a stable consumer contract, not merely public methods that happen to compile. The compiler must define two related but separate surfaces:

an internal generated ABI used by compiled functions, cmdlet wrappers, and Hybrid dispatch;
an opt-in C#-friendly public ABI for functions whose complete signature and output contract can be proven.

The public ABI records a deterministic mapping from PowerShell command identity to CLR namespace, type, method, and generated DTO identities. It also records:

parameter-set and overload mapping;
required, optional, switch, remaining-argument, and omitted-versus-bound behavior;
nullability, collection element type, output cardinality, and exception contract;
sync versus future async/cancellation behavior;
semantic-profile and compiler-runtime ABI versions;
any behavior intentionally unavailable to direct CLR callers, such as PowerShell common parameters or host streams.

Functions with heterogeneous success output, unresolved PSObject shape, host-only streams, dynamic parameters, or ambiguous parameter-set mapping do not receive a misleading typed public API. They remain internal, use an explicitly less-typed contract when the user requests one, or are omitted/rejected with diagnostics.

Generated source and the artifact manifest are the compatibility evidence. A change in normalized public signatures or generated DTO schema is an ABI change even if compilation still succeeds.

Semantic fidelity contract

Binding, lowering, and any real runtime-free support owner must explicitly cover the PowerShell behaviors most likely to produce fast but wrong code:

numeric literal typing, overflow promotion, arithmetic, comparison, and culture;
$null, missing, AutomationNull.Value, no output, scalarization, and collection enumeration;
case-insensitive string, wildcard, regex, dictionary, and member-name behavior;
expandable strings, formatting, encoding, line endings, and native-process argument rules;
truthiness and conditional conversion;
parameter binding, validation order, omitted defaults, switch identity, and error category;
success and non-success streams, terminating versus nonterminating errors, and exit codes;
lexical, script, module, dynamic, and closure scope;
property/method binding across CLR objects, dictionaries, PSCustomObject, and bounded ETS shapes;
pipeline lifecycle, record cardinality, and ordering;
platform facts, environment state, filesystem/provider behavior, and resource lifetime.

Every accepted Strict construct has a named semantic contract and a differential oracle. “It emits valid C#” is not an acceptance criterion.

Type acquisition and gradual compilation

Native-like code depends on types that are proven rather than guessed from one observed run. Type information is acquired in this order:

explicit parameter, variable, cast, and return constraints in authored PowerShell;
literal and operator semantics;
CLR constructor, property, method, generic, and overload metadata;
versioned command-family contracts;
interprocedural fixed-point inference across the reachable local function graph;
explicit compiler annotations only when standard PowerShell cannot express a useful stable contract.

[OutputType()] is useful contract evidence but not proof by itself because ordinary PowerShell does not enforce it. Authored [OutputType([void])] is advisory metadata and does not suppress success output actually produced by a function body. It is not a local-call, lifecycle-output, or recursive value contract; body inference remains authoritative, and direct self-recursion still requires one verified non-void contract. The canonical metadata policy separates authored output declarations from the optional single-CLR-type semantic contract. Hybrid binary cmdlets can preserve non-whitespace literal names and resolved CLR type lists, including repeated attributes and one literal parameter-set association per attribute, on advisory-metadata-capable targets. Strict runtime-free targets still require a target-compatible single semantic type; unsupported advisory collections, unresolved type expressions, dynamic names, and mixed forms fail closed. Validation attributes narrow accepted input but do not silently change the underlying type. Profile-guided observations and census data may prioritize work; they never specialize a Strict artifact around values seen during training.

The compiler should expose why a value became typed, widened, or unknown. One unresolved value does not automatically poison an entire Hybrid program: analysis finds the smallest safe typed region and the explicit boundary around it. Strict remains all-or-nothing over the reachable program closure.

PowerForge-specific annotations are a last resort. They must remain inert and valid in ordinary PowerShell, describe a reusable semantic fact rather than force an emitter, and be checked against actual runtime behavior. Do not require users to rewrite normal scripts into disguised C# merely to satisfy the compiler.

Command and pipeline architecture

Commands are not handled through a growing ordered if or switch spread across compiler stages.

command AST
    |
    v
canonical command and alias resolution
    |
    v
deterministic command semantic registry
    |
    v
command-family binder
    |
    v
bound command or pipeline node

The registry is keyed by resolved command identity. A command-family binder returns one definitive result:

a supported semantic shape;
an unsupported shape with a fallback reason;
or an invalid invocation diagnostic.

It does not return “try the next handler.” Duplicate owners are an architecture error.

Stream commands

One stream-semantic owner handles:

Write-Output;
Write-Verbose;
Write-Warning;
Write-Debug;
Write-Information;
Write-Error.

It produces a BoundWriteStream with stream kind, bound value, error behavior, cardinality, and effects. Emitters only render that node.

Write-Host remains separate because it is host/UI interaction rather than an ordinary stream write. Write-Progress also retains its own host capability and record lifecycle.

Projection commands

Select-Object belongs to a projection-semantic owner. Literal property selection, expansion, and bounded First, Last, or Skip shapes can produce a typed BoundProjection. Dynamic calculated properties or unsupported parameter combinations become a command region or fallback with an explicit reason.

Pipeline transformations

Typed pipeline stages have separate semantic owners:

filtering: Where-Object;
mapping: ForEach-Object;
projection: Select-Object;
ordering: Sort-Object;
later grouping and aggregation where their contracts are proven.

$_ and $PSItem bind to explicit pipeline symbols. They are not magic variable-name checks inside a backend.

General commands

Commands without typed semantics lower to a BoundPowerShellCommandRegion when the boundary is safe. The region records:

the exact source slice;
bound input values;
captured output and cardinality;
stream behavior;
required host capabilities;
state crossing the boundary.

This is the generic path for AD, CIM, remoting, filesystem, registry, and third-party commands. Their names do not become compiler intrinsics.

Runtime-free command adapters

A command can participate in Strict runtime-free compilation only through a deterministic, versioned command-family contract. A runtime-free adapter declares:

canonical command identity and supported parameter shapes;
semantic profile and version;
bound input/output type, cardinality, streams, errors, effects, and dependencies;
the CLR operation or support-runtime API used for lowering;
trimming, NativeAOT, platform, and security capabilities;
explicit unsupported shapes.

This is the path for carefully proven families such as JSON, CSV, filesystem, HTTP, or text processing. It is not permission to make every cmdlet name a special case. Prefer the platform or existing Evotec reusable owner, and keep the compiler adapter as contract plus lowering. The compiler never executes the command during analysis.

A general third-party compiler-plugin model is deferred until built-in adapters prove the registration, versioning, trust, and diagnostic contracts. Loading arbitrary analyzer packages is code execution during the build and needs an explicit security and compatibility design.

Module and dependency architecture

PowerForge already inventories local source, manifests, RequiredModules, RequiredAssemblies, NestedModules, native libraries, and runtime content. The redesign must turn that inventory into three connected but distinct graphs:

Semantic graph — source units, functions, commands, CLR members, types, effects, and fallback propagation.
Dependency graph — modules, assemblies, native libraries, resources, versions, identities, and transitive edges.
Deployment graph — what is compiled, referenced, hosted, embedded, copied, restored, externally required, or rejected for the selected artifact.

One flat file list cannot answer all three questions. A dependency node records:

canonical identity: module name/GUID/version, assembly identity, package identity, CLSID/ProgID, native library name, or content path;
discovery edge: manifest RequiredModules, NestedModules, RequiredAssemblies, ScriptsToProcess, TypesToProcess, FormatsToProcess, FileList, using module, using assembly, #requires, literal Import-Module, dot-source, CLR reference, native load, or explicit build input;
source location, hash, publisher/signature, repository/feed provenance, and license/redistribution disposition where known;
target framework, PowerShell edition/version, OS, architecture, and runtime capabilities;
semantic role and available metadata;
transitive dependencies, cycles, conflicts, and load order;
artifact disposition and the reason for it.

Module classification

The resolver classifies every reachable module before lowering:

Module shape	Analyze	Hybrid/Package	Strict runtime-free
Contained script module with source	Parse manifests/source and build a semantic graph	Compile eligible regions and preserve hosted fallback	Compile only when the complete reachable source contract is supported
Binary PowerShell module	Read manifest and static assembly/cmdlet metadata without importing it into the compiler process	Load through the selected PowerShell host; typed code may surround bounded calls	Reject command use unless a separate runtime-free adapter exists
Mixed script/binary module	Analyze each component and its shared exports/dependencies	Compose typed, binary-hosted, and script-fallback behavior explicitly	Require every reachable component to have a runtime-free lowering
CDXML/CIM, implicit-remoting, workflow, or dynamic-proxy module	Record host, endpoint, provider, and dynamic metadata requirements	Host through PowerShell when target capabilities match	Reject unless a purpose-built runtime-free owner exists
Managed library used directly from PowerShell	Read reference metadata and bind statically provable CLR calls	Compile direct CLR calls; preserve unresolved PowerShell behavior	Compile when the assembly closure and target contract are compatible
Native library or external executable	Record RID, architecture, calling/process contract, and deployment inputs	Host or invoke through an explicit bounded boundary	Allow only through a proven native/process adapter with exact lifetime and error semantics

Module names such as ActiveDirectory are workloads, not compiler intrinsics. A conventional AD script should be able to compile typed validation, transformation, filtering, and result shaping around a hosted Get-AD*/Set-AD* command region. The resulting Hybrid artifact still requires a compatible Active Directory module, PowerShell host, operating system, RSAT/server capability, and reachable service. Strict compilation rejects that command path unless a separate runtime-free AD capability is deliberately designed and validated outside the generic compiler.

Deterministic module resolution and restore

Analysis must not depend on whichever module happens to win PSModulePath lookup on the build machine. Resolution uses an explicit root set and produces a lockable graph containing exact module GUID/version, source/feed, path or package hash, PowerShell edition, architecture, and transitive identities.

The workflow separates:

Resolve metadata without executing module initialization.
Restore missing modules/packages only when the user explicitly requests acquisition from allowed repositories.
Analyze the locked inputs.
Build without changing the resolved graph.
Validate the real artifact in a clean target environment.

PowerForge must not silently download, update, or bundle a module during analysis. Version ambiguity, dependency cycles, incompatible GUID/version constraints, architecture mismatch, missing native assets, or conflicting assembly identities fail with a causal graph diagnostic.

Bundling is not the default for external modules. The deployment plan chooses one of:

compile contained source;
reference an exact managed assembly;
preserve and host an exact module;
embed/copy a redistributable dependency and its transitive assets;
restore into a private artifact-local module root;
require a target-installed module/runtime capability;
reject the dependency for this target.

License, publisher, signature, servicing, and redistribution constraints are recorded separately from technical resolvability. An installed Windows/RSAT module must not be copied into an EXE merely because the compiler can find its files.

Binary wrappers over managed libraries

Many PowerShell modules are thin cmdlet/function surfaces over ordinary .NET libraries. PowerForge should distinguish three paths:

Hosted cmdlet path: preserve PowerShell parameter binding, dynamic parameters, common parameters, streams, ShouldProcess, and module state by invoking the binary module inside PowerShell.
Direct CLR path: bind authored [Namespace.Type] calls or a proven adapter directly to the public managed API and include the exact assembly dependency closure.
Generated adapter path: expose a versioned runtime-free command adapter only when cmdlet semantics and the underlying CLR operation have a reviewed one-to-one contract.

PowerForge does not automatically bypass a cmdlet wrapper just because its implementation assembly is visible. The wrapper may own validation, security, retries, cancellation, streams, provider context, or lifecycle semantics that a direct method call would lose.

Managed resolution must account for target-framework compatibility, assembly unification, load context, binding redirects for net472, package/runtime assets, satellite assemblies, configuration, and native dependencies. A root DLL without its transitive closure is not a complete artifact.

WMI, CIM, CDXML, and management-provider boundaries

Management commands are a capability family with remote state, transport, credentials, sessions, mutable effects, and provider-shaped objects. They must not be modeled as ordinary CLR method calls or a list of recognized command names.

Windows PowerShell WMI v1 cmdlets are a named 5.1/Windows hosted profile. Hybrid can retain their exact behavior; PowerShell 7 and cross-platform targets do not silently receive a synthetic Get-WmiObject compatibility layer.
CIM cmdlets and CDXML modules use a separate management-provider contract. Hybrid can host the locked module/session behavior; Strict requires an explicit CIM/MI adapter with supported operation and target profiles.
The semantic owner binds generic management operations such as query/enumerate/get, create/modify/delete, invoke method, association traversal, and indication subscription. Command-family registrations map supported invocations onto those operations; emitters never rediscover the command semantics.
CDXML is static metadata only when its class, namespace, methods, parameters, outputs, adapter, and session requirements can be parsed deterministically. Parsing CDXML does not contact a server, load a custom adapter, or prove runtime compatibility.
A target contract records local/remote target, namespace/class/query, WS-Man/DCOM or other transport, authentication capability, timeout/throttle, platform, bitness, required modules/native assets, and whether output remains a hosted CimInstance/PSObject shape or crosses through a proven typed DTO.
Credentials, live CimSession identities, server-discovered schemas, and mutable subscriptions are runtime state. Locks and diagnostics record required capability and redacted identity, never secrets or a promise that a previously observed session still exists.
Session creation, pooling, reconnect, cancellation, partial enumeration, event subscription, target disconnect, and disposal have one provider-owned lifecycle. Hybrid and Strict surfaces consume that same lifecycle contract instead of implementing separate cleanup logic.

WMI may internally use COM/DCOM, but WMI/CIM operation semantics and general COM automation remain distinct provider contracts. A successful COM activation test does not prove WMI/CIM behavior, and a successful WMI query does not qualify arbitrary COM automation.

Native and COM interop boundaries

Native libraries and COM are capability families, not ordinary CLR calls.

Native libraries and processes

A runtime-free native adapter declares RID/architecture, library identity and hash, entry points, calling conventions, marshalling, ownership, thread safety, cancellation, error translation, and unload/process lifetime. Native files are selected from the dependency graph and validated on the target host. A matching filename beside the artifact is not sufficient proof.

External executables use a separate process contract covering arguments, quoting, environment, stdin/stdout/stderr encoding, exit codes, signals, timeout, cancellation, credentials, and child cleanup. Hybrid may retain authored PowerShell native-command semantics; Strict requires a proven process adapter.

COM

COM support should begin as an explicit Windows-only hosted capability:

Package/Hybrid can retain New-Object -ComObject, [type]::GetTypeFromProgID, or equivalent activation inside a PowerShell region;
the target contract records Windows, process bitness, ProgID/CLSID, registration requirement, apartment state, interactive/session constraints, and external installation;
COM objects do not cross a typed/hosted boundary as unconstrained object; operations remain in one hosted region or cross through a reviewed typed DTO boundary;
the host owns STA/MTA selection, thread affinity, cancellation, cleanup, and exception translation;
build and tests never activate COM merely to discover its API.

Future Strict managed COM support may use a known PIA/type library or generated interop for a finite interface set. It requires explicit interface identity, marshalling, apartment, lifetime, registration-free/deployment, bitness, and target-host tests. NativeAOT COM support remains rejected until the selected .NET/platform toolchain and generated interop path are proven for that exact contract. Do not fall back to late-bound dynamic and call it native compilation.

COM automation is not cross-platform. A script using Word, Excel, WMI-era COM, or another registered server can still gain Hybrid acceleration around the COM region, but the artifact must report its Windows/runtime/application dependencies plainly.

Hybrid and fallback ergonomics

Fallback is a supported execution plan, not an analyzer failure hidden behind a warning. The planner selects the smallest safe disposition across both the call graph and dependency graph:

direct typed operation;
typed function or region;
bounded hosted command/module/COM region;
whole-function script fallback;
whole-entrypoint Package execution when boundaries cannot be represented safely;
Strict rejection when the requested artifact forbids the required host.

Each boundary has a BoundaryContract that describes inputs, outputs, cardinality, streams, errors, cancellation, state mutation, object lifetime, host/runspace, module requirements, and thread/apartment requirements. Primitive values, proven CLR types, and generated DTOs can cross directly. Unbounded PSObject, provider objects, live directory sessions, COM RCWs, runspace-bound objects, and other host-owned state remain inside the hosted region unless a reviewed adapter normalizes them.

Fallback propagation is causal. If function A stays hosted because it calls B, which needs module C, the diagnostic chain reports all three nodes and the missing capability. Adding or resolving an unrelated module must not change registration order or select a different handler.

The user-facing plan should answer:

what compiled and at what granularity;
what remained hosted and why;
which module/runtime/platform dependencies must exist on the target;
which dependencies are bundled versus external;
what values and state cross each boundary;
whether boundary cost is likely to dominate the compiled work;
what source or contract change would unlock a stricter artifact.

Users should not need compiler annotations for ordinary Hybrid behavior. Optional policy can force a function to remain hosted or require it to compile, but policy never overrides an unsafe boundary or missing dependency.

Hybrid executable architecture

A Hybrid EXE is the compatibility bridge between Package and Strict. It is not a weaker Strict artifact.

The host packages the selected PowerShell runtime and authored fallback closure, loads a generated typed assembly, and exposes compiled functions through one explicit dispatcher/command boundary. The manifest reports typed regions, runtime fallback units, boundary crossings, embedded source, and requiresPowerShellRuntime: true.

The implementation gate is deliberately coarse:

compile complete local function graphs or large regions, not individual arithmetic expressions that cross the host boundary repeatedly;
define argument, output, stream, error, cancellation, and runtime-state transfer once;
preserve authored help and source identity for fallback functions;
resolve and preflight the locked hosted-module graph before executing the entrypoint;
isolate private bundled modules from ambient PSModulePath while leaving declared external modules external;
never allow typed code and fallback code to mutate the same unresolved scope implicitly;
benchmark boundary cost and require representative work to amortize it;
keep Package as the correct answer when no region benefits from compilation.

Hybrid EXE work starts only after the bound IR can describe the same typed/fallback plan already used by Hybrid modules. It must reuse that owner rather than grow a second executable-only analyzer or dispatcher.

Managed and native delivery architecture

The C# backend produces one deterministic generated project. Publication then selects a delivery backend:

framework-dependent managed build;
self-contained managed build;
trimmed self-contained build;
optional ReadyToRun benchmark lane, promoted only if it adds measured value;
NativeAOT build for a supported RID.

The NativeAOT lane requires:

a complete runtime-free reachable closure;
zero trim/AOT analyzer warnings in compiler-owned source;
no accidental reflection or dynamic-code roots;
explicit globalization, serialization, COM, native-library, and resource behavior;
native symbol and source-map strategy for crash diagnosis;
execution on the target OS/architecture, because cross-publication is not runtime proof;
a dependency and vulnerability manifest for compiler runtime, SDK, and native inputs.

NativeAOT is currently proven for a narrow Strict executable subset. Promotion of any additional RID requires repeatable proof on that exact operating system and architecture. The named supported set is currently win-x64 and linux-x64; macOS, Arm64, and other profiles remain experimental even when dotnet publish succeeds.

Compiler user experience

The product surface should make the compiler’s decision inspectable before a potentially expensive build:

powerforge powershell analyze <source> --target-contract <contract.json> --output json
powerforge powershell explain <source> --target-contract <contract.json>
powerforge powershell build   <source> --target-contract <contract.json> --dependency-lock <graph.json> --out <directory>
powerforge powershell build   <source> --target-contract <contract.json> --dependency-lock <graph.json> --out <directory> --emit-source

Those are the current public CLI commands. The required workflow is:

analyze without executing source;
show typed, hosted, fallback, and rejected regions with causal diagnostics;
optionally emit the deterministic C# project and source maps;
build one explicit artifact contract;
run differential tests and the checked-in target-host artifact harness;
publish/sign/package through the existing PowerForge release owner.

The CLI and PSPublishModule cmdlet only map these options to shared engine requests and format results. IDE or language-server integration can consume the same analysis result later; it does not get a separate eligibility engine.

Reproducibility, provenance, and trust

Every artifact manifest should record enough input identity to reproduce and audit the build:

compiler and support-runtime versions;
semantic profile and capability contract;
normalized source and resource hashes;
generated-source hash and public ABI hash;
target framework, RID, SDK, optimization, and relevant MSBuild properties;
resolved managed/native dependencies and lock-file identity;
runtime fallback and embedded-source facts;
build, signing, and publication identities without secret material.

Generated source should be path-stable and deterministic. Package restore is locked or otherwise provenance-bound for release builds. Signing, SBOM/provenance generation, atomic publication, and public feed/release handling remain in PowerForge’s packaging/release layer after compilation succeeds.

Compilation is not a sandbox or obfuscation boundary. The compiler must not execute input during analysis, but the generated artifact has the authority of the user who runs it. Package and Hybrid artifacts carry inspectable source and a PowerShell runtime; managed and native Strict artifacts remain analyzable binaries.

Intended source layout

The final names may follow nearby repository conventions, but responsibilities should remain recognizable:

PowerForge.PowerShell/Services/Compilation/
  FrontEnd/
    PowerShellSourceParser.cs
    ParsedSourceDocument.cs
    SourceSpan.cs
  BoundTree/
    Nodes/
    Symbols/
    Types/
    Effects/
    Diagnostics/
  Binding/
    PowerShellSemanticBinder.cs
    BindingContext.cs
    Expressions/
    Statements/
    Parameters/
    Commands/
    Modules/
  Analysis/
    TypeFlow/
    DataFlow/
    CallGraph/
    Effects/
    Capabilities/
    Dependencies/
    Fallback/
  Dependencies/
    ModuleResolution/
    AssemblyResolution/
    NativeAssets/
    Locking/
  Lowering/
    Typed/
    Cmdlets/
    Hybrid/
    Pipelines/
    Interop/
  Interop/
    Managed/
    Native/
    Processes/
    Com/
  Backends/
    CSharp/
    BinaryModule/
    Executable/
  Reporting/
    Census/
    SourceMaps/

PowerForge.CompiledRuntime/               # create only when shared emitted helpers justify it
  Values/
  Conversion/
  Enumeration/
  Comparison/
  Errors/
  Streams/

This is an ownership map, not permission for a folder-only rewrite. Create each area when its first real semantic slice migrates.

Milestone summary

Milestone	Status	Result
0. Freeze and inventory current contracts	Complete	A trustworthy behavioral and ownership baseline
1. Establish compiler boundaries	Complete	Parsing, semantic IR, lowering, backends, reporting, and artifact contracts have one-way boundaries
2. Implement foundational bound IR	Complete	Simple functions compile through IR
3. Add deterministic analysis passes	Complete	The semantic call graph is the sole graph authority and fixed-point results are order-stable
4. Separate lowering from emission	Complete	Backends and statement-level source maps consume lowered contracts
5. Migrate all current behavior	Complete	The pre-existing compiler surface and executable invocation shaping were migrated; Milestone 10 must move its later hosted lifecycle path onto the same boundary
6. Define runtime-free artifact contract and managed ABI	Complete	Strict publication is fail-closed and ABI schemas 4/5 carry value state, output/null/cardinality, streams, and binding semantics
7. Preserve help and module contracts	Complete	Compiled functions retain full help/export behavior
Semantic pipeline migration checkpoint	Complete	Publication certification, consumed locks, command-family lowering, lifecycle ownership, and canonical semantic ownership are closed; current file-growth work remains in the maintainability gate
Core semantic pipeline gate	Complete	Parser, binder, bound IR, lowering, backend, delivery, and explainability have canonical owners
Extensibility/profile architecture gate	Complete within promoted profiles and provider ABI 5	Effective semantic profiles, exact-host oracles, authoritative package/signer policy, full bounded provider conformance, Strict-executable host ABI, NativeAOT adapter execution, one representative external filesystem operation, and bounded process-isolated provider initialization are implemented
8. Build command and pipeline semantics	Complete	Deterministic injected providers, typed family stages, complete CLR stream sinks, and runtime-free adapter execution share one semantic route
9. Resolve modules, dependencies, and interop	Complete / planning contract	Builds consume exact graph locks; transitive module, managed, native/process, and COM dispositions are deterministic, while executable clean-target ecosystem qualification continues in Milestone 19
10. Complete advanced-function lifecycle	Complete	Canonical lifecycle IR preserves raw records, guarantees cleanup, and enforces PowerShell 5.1/7/7.3+ behavior explicitly
11. Complete value and object flows	Complete / bounded contract	Known object and collection shapes compile while arbitrary ETS identity remains an explicit fallback boundary
12. Expand bounded runtime state	Complete / bounded contract	Read-only invocation state propagates through IR and call graphs; mutable dynamic scope remains runtime-backed
13. Run generic coverage waves	Complete / bounded wave	The product-neutral corpus and caller-supplied replaceable census proved the generic prioritization mechanism; Milestone 20 now owns the fixed public packet and future expansion
14. Productize managed, Hybrid, and native delivery	Complete / bounded supported profiles	`Build-Module` can convert arbitrary staged script modules into measured Hybrid or Strict binary modules; exact target contracts, evidence, verified caching, Hybrid EXE, native closure inspection, and target-host execution support Strict `net10.0` framework-dependent and NativeAOT EXEs on `win-x64` and `linux-x64`; all other named profiles remain experimental
15. Optimize proven IR	Complete	Three immutable IR rewrites plus five backend-lowering/source-evidence optimization families, authored source/PDB mapping, measured boundary cost, and clean-candidate benchmark evidence preserve the differential and artifact contracts
16. Productize the provider SDK and trust model	Complete within provider ABI 5	Versioned providers are authoritatively identified, locked, and executable through one bounded route; typed results, streams, errors, cooperative and process-isolated cancellation, deterministic cleanup, dependency closure, NativeAOT, and one representative external filesystem operation are observed
17. Add compiler explainability and reproducible diagnostics	Complete	Human and versioned JSON explain output, semantic fingerprints, integrity-bound reproduction evidence, source/boundary failure mapping, optional semantic-only IR, auditable cache/graph/ABI/fallback/provider decisions, and local-only retention/redaction policy are implemented
18. Establish versioned semantic oracles	Complete within the promoted Windows profiles	Named profiles govern target identity and compilation; observations carry integrity-bound executable/runtime identity, promotion rejects missing pins or unexplained differences, all 31 interpreted cases execute across all three host profiles and the 24-case promoted runtime-free subset has matching Strict results, explicit `AutomationNull` plus framed nullable/string/culture observation are implemented, and a deadline-bound Job Object boundary reconciles completion packets with cumulative process accounting before recording ordered direct-child launches/exits separately from final `LASTEXITCODE` state
19. Qualify real dependency and interop ecosystems	Partial / one authorized external gate	Signed binary wrappers, the complete typed CIM/MI and LDAP families, bounded process-isolated LDAP initialization, locked native delivery, remote execution, session reuse, bounded results, authentication failure, mutation, and safe failure/cleanup cases are proven; only the controlled target-reboot/reconnect exercise remains open
20. Establish generic measurement and expand useful coverage	Complete / bounded benefit packet	Public and external baselines are enforced, four emitted commands run with parity across three scenario families, and the realistic Strict application proves dependency, resource, streams, bounded errors, and counterbalanced fresh-process startup on Windows/Linux
21. Productize project, lock, restore, and package UX	Partial / local workflow complete	Effective-profile restore/build/test/pack/install uses complete target and artifact-set identity; only explicitly authorized public lifecycle proof remains open
22. Broaden platform and profile-guided performance maturity	Partial / target qualification	The support matrix and measured recommendation/budget policies are implemented; physical macOS/Arm64 and additional profile promotion remain open
23. Compile module-scale state and regions without a second runtime	Complete through M26	Live Hybrid state, guarded prefixes, multiple non-overlapping additional regions, schema-6 transfer contracts, real module workflows, and independent Strict stateful-library lifetime are qualified; unproved dynamic/borrowed/provider behavior remains outside the accepted subset
24. Values, collections, and error continuation	Complete / bounded qualified families	Numeric promotion, cardinality, fresh-vector ownership, enumeration failure, cleanup, and continuation have dual-host workflow proof
25. Complete pipelines and advanced functions	Complete / bounded qualified families	Whole commands preserve every record, local-call output, binding, streams, stop, cancellation, and cleanup through admitted owners; stopping fixtures wait for native engine acknowledgment
26. Stateful modules and multiple Hybrid regions	Complete / bounded M23 contract	Hybrid keeps one state owner while selecting approved regions from each canonical non-overlapping run; M24 value/local-call contracts compose with those regions, and Strict stateful libraries have an independent runtime-free lifetime owner
27. Practical CLR library consumption	Complete / bounded local-feed consumption	Static/stateful consumers, deterministic rebuilds, cancellation-safe publication, canonical NuGet metadata, and required ABI/provider gate families; consumer upgrades require restore/rebuild
28. Source-first development loop	Complete / bounded local workflows	Run, incremental rebuild, explain/diagnose, package, and two-host module consumption use the existing project service; interactive debugging is deferred and unqualified
29. Complete script and module coverage	Current / multi-wave	At least 30 additional executed complete functions on the fixed packet, plus two module workflows and one script/application workflow with differential proof
30. Distribution and qualified platforms	Partial / external gates	M19/M21/M22 close for the declared release set and actual supported targets
31. Acceleration of proven workflows	Planned / later optimization	Useful complete workloads receive measured performance improvements after semantic qualification

Closure sequence completed on this branch:

Make uncertifiable Strict delivered closure fail publication and add a build-level rejection test.
Add a first-class reviewed dependency lock, verify source/dependency hashes at consumption, and reject drift.
Move hosted lifecycle discovery/binding into the canonical front end, preserve the original pipeline record, and make cleanup plus PowerShell-version behavior explicit.
Promote command-family metadata into typed semantic/lowered nodes, complete CLR stream ownership, and prove injected runtime-free execution.
Run external-module, managed-wrapper/provider, native/process, and Windows COM clean-target disposition fixtures without executing authored source or activating external capabilities; executable ecosystem qualification remains Milestone 19.

Milestone 0 — Freeze and inventory current contracts

Exit gate: the refactor has a behavioral baseline and an explicit ownership map. No current behavior depends on undocumented assumptions.

Milestone 1 — Establish compiler boundaries

Define the dependency direction between parsing, binding, IR, analysis, lowering, backends, reporting, and artifact orchestration.
Define how module/assembly resolution, explicit restore, dependency locking, and interop capabilities feed the compiler without importing/executing source modules.
Define a neutral SourceSpan that does not expose SMA AST objects.
Define immutable symbol identities for files, functions, parameters, locals, pipeline variables, and generated commands.
Add one minimal parser-to-binder-to-backend path.
Remove AST consumption from backends and from Strict executable parameter/invocation shaping; AST remains a parser/front-end input.
Prevent binders from producing C# strings.
Keep the IR internal until a real external consumer requires a stable public API.

Exit gate: an empty or literal-returning program flows through the complete new pipeline.

Milestone 2 — Implement foundational bound IR

Program, source document, function, parameter, block, statement, and expression nodes.
Symbols and lexical scopes.
Literal, variable, assignment, conversion, invocation, and return nodes.
PowerShell type and CLR representation models.
Type-fact provenance explaining explicit, inferred, command-contract, widened, and unknown results.
Value state and output cardinality.
Effects and required capabilities.
Execution disposition and stable fallback reasons.
Source spans on every node that can produce a diagnostic or generated line.

Exit gate: the simplest existing Strict functions compile entirely through bound IR with equivalent source-map evidence.

Milestone 3 — Add deterministic analysis passes

Exit gate: reversing input-file and function-declaration order produces equivalent bound plans, diagnostics, and artifacts.

Milestone 4 — Separate lowering from emission

Define lowered function, parameter, local, control-flow, stream, pipeline, command-region, and return forms.
Move target selection into lowering.
Make the C# backend render lowered nodes only.
Remove local and return type inference from the C# emitter.
Remove eligibility and fallback decisions from emitters.
Remove command recognition from emitters.
Make source maps consume bound/lowered spans and record generated ranges plus source line/column ranges at statement-level diagnostic precision.
Make census consume the shared semantic result.

Exit gate: the C# backend builds without a reference to PowerShell AST types.

Milestone 5 — Migrate all current behavior

Migrate one semantic area at a time. Each completed item includes deletion of the equivalent legacy path.

Exit gate:

all existing compiler tests exercise the IR path without a structural or AST-aware semantic veto;
current generic corpus behavior is preserved;
direct AST-to-C# semantic and artifact-shaping paths are deleted;
no compatibility switch silently routes new features through the legacy emitter.

Broad coverage work remains frozen until this gate passes.

Milestone 6 — Define runtime-free artifact contract and managed ABI

Exit gate:

two or more Strict backends consume the same versioned runtime-free primitives when such helpers exist, or the manifest explicitly records that the artifact has no runtime substrate dependency;
a generated CLR library can be referenced from a clean C# consumer with a documented stable signature;
NativeAOT analysis reports no compiler-owned trim/AOT warnings under a fail-closed warning policy;
an uncertifiable Strict artifact cannot be returned as a successful certified build;
inspection of every supported delivered artifact format, not only generated source or managed metadata, proves the absence of a PowerShell runtime and source fallback.

Milestone 7 — Preserve help and module contracts

Bind comment-based help as function metadata.
Reuse the existing documentation engine to generate external MAML for compiled cmdlets.
Preserve synopsis, description, parameter help, examples, notes, links, inputs, and outputs.
Preserve aliases, exports, and mixed Hybrid command identity.
Verify Get-Help for typed and retained commands in the same module.
Refresh the product-neutral baseline and wider pinned census.

Exit gate: compiling a function does not remove or degrade its help or exported command contract.

This is the first new module-surface feature after migration because it proves that source metadata can flow through the IR, lowering, generated module, and artifact validation paths. It also removes the current help-preservation barrier from real-module coverage measurements.

Implemented evidence from the 2026-08-28 closure candidate is refreshed after the final validation run below. The review-remediation wave specifically proves that:

known PSCustomObject note-property reads convert from the adapter result to the bound CLR type instead of emitting uncompilable assignments;
duplicate bounded Add-Member writes preserve the original value and emit a nonterminating error, while supported IList operands enumerate during array concatenation;
absent environment variables remain semantically nullable/unknown through ABI emission;
hosted lifecycle plumbing reads the original pipeline record privately and does not add a public or bindable synthetic parameter;
Strict closure reconciles every delivered dependency against the consumed reviewed graph, whose exact identities include managed culture/public-key-token/content hash and module GUID/content hash;
target reference-pack certification uses the selected framework catalog, including the complete net472 reference assembly set rather than the generated-code implicit-reference subset.
delivered managed closure admits only reviewed, existing, deliverable dispositions with exact content hashes; an external/missing node cannot authorize staged bytes merely because its name and assembly identity match;
Hybrid dependency resource hashes cover the rewritten embedded bytes that the host extracts and verifies;
the generated workspace and emitted project pin the same exact SDK version recorded in provenance and the cache key;
cache restore rejects reparse-point files and ancestors before reading payload bytes;
net472 target-runtime identity includes both the top-level reference assemblies and the complete facade set;
target promotion state is compiler-owned, so an explicit RID contract cannot self-assert Supported.
schema-v1 and schema-v2 target identities authenticate their stored support state before migration, then reclassify against current compiler policy and receive a new schema-v2 identity without preserving caller provenance as semantic target identity;
target-only analysis applies the contract before RID/TFM dependency planning, so analyze, explain, and the reviewed build consume one graph; NativeAOT locks use the exact runtime-pack version declared by the selected SDK rather than the highest ambient same-major pack;
cache keys cover canonical restore results, actual resolved package bytes, and the selected SDK/reference-pack bytes, while copied payloads are rehashed before atomic restore;
the first explain schema includes file-level blockers and missing dependencies and redacts authored absolute paths as well as omitting path-bearing source identities;
the published complete PowerShellCompiledMethod constructor signature remains available while exact hosted-region counts use a new overload;
existing-artifact target-host validation recomputes artifact hashes and sizes and binds each supplied file to its managed or NativeAOT target, deployment, format, architecture, support, and verified closure before execution;
optimization evidence schema 3 reports three immutable IR rewrites, five backend-selection optimizations, and source instrumentation separately; benchmark metadata records the ReadyToRun SDK, and boundary results are explicitly an overhead ratio.

Integrated evidence from the final 2026-08-29 closure candidate:

at exact branch head 06ffe2a412528a2fe4b2498fd0bdd4ecb067cdbf, the compiler category passed 938 executed tests with zero failures on both Windows and Linux/WSL; each run retained the same one explicit certificate-dependent signing skip. The same head built net472, net8.0, and net10.0 with zero warnings and errors, and the final independent review plus targeted compatibility confirmation reported no remaining findings. This is exact-head branch evidence, not source-code coverage, a default-branch merge, public package, or released-product proof. Certificate-backed signing remains a separate live acceptance gate when a suitable Windows identity is configured;
public PowerShell DSL acceptance built unrelated arbitrary module identities through Hybrid and Strict modes, verified Strict rejection, exact ZIP and managed local-repository package contents, temporary installation, extracted import/invocation, checkpoint reuse, and source/resource/payload tamper rejection;
an earlier certificate-backed public DSL acceptance signed the exact finalized payload, recomputed canonical manifest and per-file hashes after signing, verified the recorded certificate/signature counts, extracted the ZIP, revalidated Authenticode status, and invoked the delivered command; the current candidate retains this as an explicit live gate rather than claiming it from the skipped run;
compiler checkpoint reuse now requires a cryptographically valid detached CMS signature from the currently configured signing identity and binds compiler/core assembly bytes, the complete staged-source tree, exact pre-compilation staging identity, dependency-lock content, target and compilation settings, and the complete normalized non-secret transformation, build, signing, artifact, publication, and installation plan; reuse revalidates the canonical manifest, staged root module, exact inventory, artifact identity, and payload hashes;
finalized payload hashes are captured after checkpoint finalization and checked after lifecycle hooks and before every delivery boundary; staging, packed ZIP, unpacked folder, managed repository package, and installed-module roots all receive the same portable canonical finalization after their last mutation, checkpoint authority stays machine-local, and signed archives add refreshed post-sign evidence plus detached CMS authority;
canonical compiler diagnostics, decision trace, reproduction evidence, and manifest survive staging and delivery; manifest schema 13 embeds one immutable unit-disposition ledger whose metrics are consumed by coverage, explain, census, reproduction, and boundary evidence without counting manifest hooks, hosted lifecycle wrappers, or promoted sub-function regions as fully emitted authored units, and binds the exact target-specific NuGet closure lock consumed by a project build;
final reviewer regressions prove case-correct per-source dependency causes, separate delivery-wide requirements, fail-closed inaccessible explicit/CompleteModule payload, diagnostic-path tamper rejection, post-copy unpacked inventory refresh, and AutoRevision signing evidence restricted to byte-identical verified payload;
PSPublishModule.csproj and its compiler project references built with zero warnings and errors for net472, net8.0, and net10.0 on Windows and Ubuntu after the final compatibility changes;
the final target-host lane rebuilt and executed Strict net10.0 framework-dependent and NativeAOT artifacts on Windows 10 x64 with PowerShell 7.6.4 and Ubuntu 24.04.3 x64 with PowerShell 7.6.5; both profiles preserved exact Unicode/resource output, returned 1 for invalid arguments, survived executable/native-closure inspection, and exercised cancellation, while Windows PowerShell 5.1 revalidated the same Windows artifact hashes and a one-byte tamper was rejected before execution;
the portable generic Hybrid corpus emits 8/8 functions (100%) with zero retained-source fallback or eligible-function loss; one emitted function truthfully records its bounded hosted command region as runtime-routed without reducing typed coverage;
the final seven-suite Windows benchmark packet records clean exact head 009901b0bbf56285a1ab291e2a1bff760e05a4c9, zero validation failures, explicit ReadyToRun SDK 10.0.303 metadata, generated artifact hashes/sizes, and refreshed computation, startup, local-call, dispatch-amortization, and boundary-overhead results;
earlier closure review waves identified five blocking and two documentation findings that were remediated at their owners; the final current-head independent review result is recorded with the final validation packet rather than inferred from those older candidates;
a replaceable external-source census snapshot reports 122/1,235 emitted functions (9.88%), 21 analyzer-eligible functions routed to fallback, 1,263 authored files, 1,353 units, and zero parse errors; those caller-supplied inputs are scale evidence, not committed compiler configuration;
all compiler behavior and prioritization remain keyed to generic syntax, semantic IR, dependency, host, target, resource, and artifact contracts; repository and module identities never select behavior;
semantic lowering is the eligibility authority; structural diagnostics are mapped from canonical semantic features and cannot independently veto a successfully lowered unit;
semantic IR collections take immutable snapshots, document identities are relocation-stable and filesystem-case-aware, loop variables retain PowerShell function scope, and generated literals cover control characters plus non-finite floating-point values;
typed targets reject native-process effects before emission, while strict dependency verification rejects managed System.Diagnostics.Process.Start references before runtime-free certification;
the former 139/1,235 result is retained in the companion guide as a historical snapshot of the deleted direct AST emitter, not represented as current all-IR coverage;
the lowered C# method backend has no reference to System.Management.Automation.Language; the former direct AST-to-C# emitter files, transpiler graph reconstruction, and AST-aware Strict executable shaping are absent;
deterministic graph schema 5 snapshots drive analysis/build planning and manifest schema 13; build requires a reviewed lock by default, marks an explicit development opt-out as unreviewed, rejects source, exact-identity, content-hash, delivered-closure, and analysis-to-build drift, records selected manifest identities separately from requested constraints, resolves local/acquired transitive modules plus managed/P/Invoke closure without importing source, and records managed, native, process, and literal New-Object -ComObject boundaries;
PowerShell 7 Hybrid advanced-function fixtures preserve original pipeline-record identity and properties while executing begin, per-record process, end, and clean through a hosted SteppablePipeline; cleanup runs across begin/process/end failure paths, PowerShell 5.1 behavior and pre-7.3 clean rejection are explicit, and Strict rejects hosted-only lifecycle;
deterministic external command-provider registration, typed projection/filter/map/sort stages, distinct information and Write-Host/PSHOST sinks, complete PowerShell stream ownership, and injected runtime-free adapters flow through the canonical semantic/lowered contracts; the strict library proof executes an injected provider without an SMA dependency;
the clean-target interop matrix records TFM/RID/bitness, ownership, error, cancellation, cleanup, threading, and COM apartment contracts without activating COM or executing authored source; actual adapter execution remains profile-specific, while supported-RID promotion passed for the bounded Strict executable profiles named in Milestone 14;
the repository-wide 800-line command still reports pre-existing owners; the formerly 1,200–1,900-line active compiler planning and execution owners were split by responsibility. The current closure also reduced ModuleBootstrapperGenerator.cs to 902 lines and PowerShellBoundCSharpBackend.cs to 708 lines by extracting named responsibilities, restoring hard-ceiling compliance and practical growth headroom.

Current 2026-08-30 expansion evidence keeps each proof lane separate:

the focused compiler category passes 1,012 tests with zero failures and one explicit certificate-dependent signing skip on Windows; omitted compatibility profiles resolve to Windows PowerShell 5.1 for net472 and PowerShell 7.6 for modern targets, while explicit and migrated project profiles remain authoritative. Instrumented coverage for the compiler owner is 52.32% line and 43.60% branch, while the separately packaged provider SDK is 88.60% line and 58.10% branch;
the fixed public packet passes baseline-gated Hybrid build/import/invocation for 10/10 unrelated public modules and target execution for 4/4 Strict programs on Windows and Linux; these are complete-program packet rates, not estimates of PowerShell-language coverage;
at that snapshot, the Hybrid packet analyzed 735 authored units, emitted none, and retained or runtime-routed all 735 without omission or rejection; the Strict packet analyzed, bound, and emitted all 18 authored units without fallback, including 11 methods in a realistic four-file application. This deliberately exposed the gap between broad package compatibility and native typed emission measured on 2026-08-30;
isolated restore now authenticates each archive against NuGet's canonical signed/unsigned content identity, verifies raw archive and extracted payload bytes separately, and requires the generated compilation project to consume the selected target packages.lock.json in locked mode. The durable manifest binds that closure-lock SHA-256, and regression tests reject mutable-sidecar package substitution, extracted-file tampering, and missing or additional actual restore packages;
two clean quick benchmark packets at implementation head 99c1ad0fc9a25aae5b71eb6f308cebf339fa2fbe completed every lane without validation failure. The repeated build/import qualification rows remained within the prior quick reference envelope; these are smoke and variance evidence, not a replacement for the full promotion packet or a universal performance promise;
net472, net8.0, and net10.0 compiler-owner builds and the net10.0 CLI build complete with zero warnings or errors. Physical macOS/Arm64, signed external-module/transitive-wrapper, remote management, and public package lifecycle evidence remain open exactly where Milestones 19, 21, and 22 say they do.

Green tests prove the tested branch candidate and artifact profiles. They do not certify an opaque native closure, substitute for the separately recorded NativeAOT target-host execution, establish current default-branch integration, publish a package, or prove a release.

2026-08-30 independent maturity reclassification and closure

The validation review at branch head afe1946a344352ee8cb9fa534be5aeda34b95f68 reproduced the then-current external assessment online and offline: 6/6 inputs, 154 source files, zero parser errors, 3/185 emitted units, 3/173 emitted functions, and zero complete-workload executions. Fifty-three focused semantic-oracle, fuzzing, provider, management, interop, project-workflow, lock, maturity, and census tests passed. It also exposed nondeterministic SDK selection. The integrated branch now pins SDK 10.0.303 with roll-forward disabled; normal build/test/CLI entrypoints consume that supported selection rather than an ad hoc dotnet exec workaround.

The review established four corrections; this branch has closed their architecture portions as follows:

SemanticProfileId participates in the normalized target/hash, binder/lowering, provider selection, cache/artifact identity, diagnostics, and compatible #requires decisions. Exact-host per-feature oracle evidence now covers every promoted semantic family.
provider packages are reconciled with canonical .nuspec identity and reviewed signer policy, and separately built adapters execute through Strict managed, Strict NativeAOT, Hybrid, and binary-module artifacts without compiler loading or source-specific branches. The executable matrix observes typed results, every stream, errors, cooperative cancellation through a generated host and local call graph, adapter-owned exclusive-file cleanup after normal return, failure, and cancellation, and one representative external filesystem operation from a native PE.
at review time, the semantic-oracle harness did not preserve every claimed observation, pin every exact host artifact, or automate immutable-profile monitoring. The current branch now carries reviewed exact pins for all three promoted hosts, native cases for every promoted family, a bounded schema-3 structured envelope, a read-only scheduled upstream monitor, explicit selected-property AutomationNull identity, a versioned framed Strict-observation protocol for nullable/string/culture-sensitive values, runtime-free differential evidence for every promoted family, and direct ordered OS child-process launch/exit evidence. Final LASTEXITCODE remains a separate mutable state observation and is never substituted for process history.
at that review snapshot, the fixed public Hybrid packet proved safe compatibility rather than typed benefit because it emitted 0/735 units, while its baseline remained enforced. The then-current opt-in external benefit packet separately proved 4/4 emitted commands across three scenario families, so safe packaging and measured typed benefit remained distinct evidence lanes.

The branch's former 36-commit gap was resolved by integrating origin/main, and the post-integration focused gates were rerun. These findings did not reopen the canonical parser → binder → bound IR → lowering → backend design. Exact-host oracle coverage, the bounded provider conformance/family gate, and the three-family Hybrid benefit packet are now closed; useful external ecosystems, additional physical targets, and authorized release proof remain explicit product gates.

Semantic pipeline migration checkpoint — Complete

The original semantic/back-end consolidation closed, but exact-head artifact and lifecycle review reopened the product-level checkpoint:

Exit gate: the integrated candidate has one eligibility, consumed graph lock, executable contract, semantic ABI, source-map, lifecycle, and fail-closed closure authority; focused proof remains green; and active semantic owners have enough responsibility-based headroom for the next milestone rather than merely remaining below the 1,000-line ceiling.

Milestone 8 — Build command and pipeline semantics

Exit gate: adding a supported Select-Object shape does not require coordinated semantic edits to analyzer, transpiler, emitter, Hybrid composer, and census.

Milestone 9 — Resolve modules, dependencies, and interop

Exit gate:

the build consumes the same reviewed dependency lock used for analysis, manifest evidence, and clean-target validation, and rejects post-analysis drift;
a Hybrid artifact can preserve a required external module and compile safe surrounding regions without pretending the module became native;
a managed-wrapper graph contains or requires its complete transitive assembly/native closure, while Strict publication rejects every native closure the target-host verifier cannot certify exactly;
missing, ambiguous, incompatible, cyclic, or non-redistributable dependencies fail or remain external exactly as planned;
COM and native capability requirements are visible in diagnostics and the artifact manifest.

Milestone 10 — Complete advanced-function lifecycle

Exit gate: representative conventional advanced functions execute as generated cmdlets with PowerShell-equivalent invocation and lifecycle behavior.

Milestone 11 — Complete value and object flows

Exit gate: common object-shaping helpers compile without pretending arbitrary ETS behavior is statically known.

Evidence: Strict generated-module tests execute array concatenation, ArrayList, and object-shape flows; Hybrid differential proof keeps PSCustomObject identity observation on fallback; the generic corpus adds unrelated object and collection helpers without product-specific names or branches.

Milestone 12 — Expand bounded runtime state

$PSScriptRoot and $PSCommandPath in supported packaged artifact contexts.
read-only target/runtime constants, including supported platform, edition, version, path, and invocation-state values.
classify mutable script/module tables and caches as explicit runtime-backed boundaries instead of snapshotting shared mutable identity.
$Error as one read-only per-invocation collection snapshot with mutation and method invocation rejected.
supported preference variables: verbose, debug, warning, information, error-action, progress, and confirm.
read-only environment-variable access with environment-provider mutation rejected.
read-only process, user-home, and current culture/UI-culture values with assignment still rejected.
closures and hosted command regions with statically proven captures.
explicit mutation and lifetime boundaries for environment, variable-provider, script, global, private, and $Error state.

Arbitrary global state, variable-provider escapes, uninspectable closures, and dynamic scope remain runtime-backed.

Exit gate: supported runtime state is represented in the IR and propagated through call graphs without special emitter checks.

Evidence: runtime-state expressions lower through one intrinsic policy, generated cmdlets capture one invocation-state dictionary, typed local calls receive the same snapshot, and net8/PowerShell 7 plus net472/PowerShell 5.1 differential tests cover process identity, user home, current culture/UI culture, preferences, common-parameter overrides (including the hosts' distinct -Debug behavior), and $Error where those hosts are available. The expanded pinned-host matrix reviews the process/user/culture case under every semantic profile.

Milestone 13 — Run generic coverage waves

Coverage work resumes through semantic families in this order, adjusted by each fresh census:

Each wave must:

improve a generic semantic contract;
add PowerShell differential evidence;
prove Strict rejection and Hybrid fallback boundaries;
rerun the product-neutral corpus and wider pinned census;
show benefits across unrelated inputs without product-specific branches.

Function percentage is not the only metric. Track:

fully typed functions;
Hybrid functions with typed regions;
emitted versus analyzer-eligible functions;
typed statement or region coverage;
fallback feature families;
dependency-closure success;
runtime differential pass rate;
artifact size and performance for meaningful workloads.

Completion here means the current ten bounded waves went through the generic semantic pipeline and their unsupported variants remain explicit diagnostics. It does not mean arbitrary PowerShell syntax, ETS, dynamic scope, commands, or interop are compiled. The current product-neutral corpus is 8/8 emitted functions with zero retained-source fallback and one bounded hosted command-region route; one replaceable caller-supplied external-source snapshot is 122/1,235 emitted functions with zero parse errors. Future coverage gains continue through the same census-driven process without reopening this ownership gate.

Milestone 14 — Productize managed, Hybrid, and native delivery

Milestone 14 closes the bounded artifact-delivery contract independently of Milestone 17: target contracts, exact source/dependency/native evidence, generated source maps, provenance, SBOMs, and target-host execution are sufficient to promote a deliberately narrow target set. Milestone 17 subsequently completed user-facing causal traces, redacted reproduction evidence, optional semantic-only IR, diagnostic audits, and authored-source failure mapping without changing the supported delivery profiles proved here.

Current target-profile contract:

Artifact profile	External runtime requirement	Runtime evaluation	Current promotion state
Strict/Hybrid CLR library, portable `net472`/`net8.0`/`net10.0`	compatible .NET runtime	no hosted fallback in the delivered library	Supported within the bounded CLR ABI and clean-consumer tests
Strict/Hybrid binary module, portable `net472`/`net8.0`/`net10.0`	compatible PowerShell host	generated cmdlet/host lifecycle as declared	Supported within the tested PowerShell 5.1/7 host matrix
Package or managed Hybrid EXE, framework-dependent	compatible .NET runtime; PowerShell SDK/source closure is packaged	yes	Implemented; named RID/platform promotion remains experimental
Package or managed Hybrid EXE, self-contained/trimmed	no separately installed .NET or PowerShell runtime	yes	Build and benchmark contracts are implemented; each explicit RID remains experimental
Strict managed EXE, framework-dependent	compatible .NET runtime	no	`net10.0` `win-x64` and `linux-x64` are Supported; portable builds remain `PortableManaged`; other named profiles remain experimental
Strict managed EXE, self-contained/trimmed	none	no	Build and benchmark contracts are implemented; named profiles remain experimental
Strict NativeAOT EXE	none	no	`net10.0` `win-x64` and `linux-x64` are Supported after exact native-closure inspection and target-host execution; other named profiles remain experimental
ReadyToRun	depends on deployment choice	profile-dependent	Benchmark-only; public target requests are rejected

RuntimeRequirement records what the target host must supply. AllowsPowerShellRuntimeEvaluation separately records whether the artifact can enter a hosted source/fallback boundary; bundling PowerShell SDK assemblies does not falsely turn that capability into an external PowerShell installation requirement. A RID is never marked supported from cross-publish alone.

Exit gate:

A user can analyze and explain one explicit target contract, then build it with optional --emit-source through the public entry points, while the checked-in target-host harness tests the artifact execution contract without requiring compiler internals.
Generated CLR libraries are consumed from clean C# projects, Strict EXEs run without PowerShell, and every named supported NativeAOT RID runs on its target host.
Hybrid EXEs report the bundled runtime, embedded source, typed coverage, fallback closure, and measured crossing cost truthfully.
Manifests and release evidence distinguish source, managed artifact, native artifact, signing, and publication state.
Public Build-Module configuration can opt an arbitrary compatible module into Hybrid or Strict compilation without consumer-specific code, and every downstream delivery phase consumes the exact finalized compiler payload.

Milestone 15 — Optimize proven IR

immutable constant folding for conservative pure literal operations while retaining authored source spans.
immutable dead-branch elimination for statically literal if/while conditions while retaining selected authored spans.
allocation-reducing backend selection for empty arrays and list concatenation without changing collection/cardinality semantics.
bind adjacent compatible pipeline stages into one hosted invocation and report the avoided crossings as backend-selection evidence.
bind adjacent hosted operations with the same boundary contract into one command region and report the coalesced statement count.
select indexed backend emission for proven typed-array iteration.
emit repeated proven generic conversions through one cached per-method conversion helper.
instrument generated source and PDBs through authored-document publication and #line sequence mapping.

Exit gate: Complete. Three immutable rewrite passes and the separately classified backend/instrumentation optimizations preserve differential and artifact contracts, expose truthful evidence, and the clean exact-head suite records meaningful typed-kernel, local-call, startup, artifact-footprint, and boundary-amortization results. Small host-dominated workloads are not used to justify compiler-wide complexity.

Milestone 16 — Productize the provider SDK and trust model

Exit gate: Complete within provider ABI 5. A separately built provider package is reconciled with canonical NuGet metadata, governed by package/publisher/license/signer policy, locked by exact archive and assembly identity, metadata-validated without loading it into the compiler, and invoked from generated Strict managed, Strict NativeAOT, Hybrid, and binary-module artifacts through the canonical registry/lowering route. The route proves closed scalar/collection string and primitive-value types, all seven stream sinks, terminating errors, cooperative host cancellation, adapter-owned exclusive-file cleanup after normal return, failure, and cancellation, an exact transitive managed assembly at runtime, and one representative external filesystem operation compiled into and executed from a native PE. ABI 5 additionally permits a reviewed runtime-free provider to declare a closed scalar string operation as process-isolated with a one-to-3,600-second deadline; generated Strict executables create one-use inherited anonymous-pipe capabilities, emit only the provider-ID switch reachable from the entrypoint call graph, exchange length-prefixed bounded frames, keep the direct worker alive until the response is consumed, then kill the complete worker tree; ordinary authored or provider-owned process launch remains forbidden. Library, binary-module, and Hybrid hosts fail closed for this contract. This closes the extensibility architecture and bounded conformance gate; it does not claim arbitrary filesystem commands, HTTP, directory, management, native/process, or COM coverage. Those useful provider ecosystems remain Milestone 19 work. Public feed publication remains a separate release decision.

Executable entry points are accepted only from exact reviewed provider-package locks; direct command-provider inputs cannot bypass package trust with an entry point or external-operation declaration. The SDK packer, compiler package reader, and semantic registry share the same executable-contract shape validator. Strict observation frames ordered success, information/host, warning, verbose, debug, and nonterminating error records, and bound/lowered IR evidence reports the runtime-free provider capability without misclassifying it as hosted PowerShell streams.

Milestone 17 — Add compiler explainability and reproducible diagnostics

Emit a stable decision trace linking source spans to bound features, inferred types/value states, capabilities, provider resolution, dependency decisions, fallback/rejection causes, lowering choices, and artifact disposition with deterministic ordering and relocation-safe source identity.
Add explain output for humans plus versioned JSON for tools, with deterministic ordering, relocation-stable identities, and absolute-path redaction.
Produce integrity-bound redacted reproduction evidence containing normalized source identities and hashes, compiler/semantic-profile and toolchain identities, target contract, provider contracts, dependency lock, generated source hash, ABI hash, source-map hash, trace hash, and diagnostics hash including portable diagnostic file identity, without copying authored source, secrets, absolute paths, or machine-owned state.
Map build, trim/AOT, dependency, ABI, and runtime failures back through statement-level source maps and boundary contracts instead of exposing generated-project internals as the primary diagnosis.
Add optional bound/lowered IR snapshots suitable for diffing while keeping parser AST objects, authored source text, and executable hosted source out of runtime-free semantic payloads.
Record cache hit/miss reasons, graph/ABI drift, fallback crossings, and provider selection so performance and reproducibility claims can be audited.
Add golden compatibility tests proving equivalent inputs produce equivalent semantic fingerprints across path relocation, input/declaration order, and the supported host build lanes while retaining parameter order as a semantic contract.
Define local-only retention and redaction policy for diagnostics, crash bundles, generated source, and optional IR evidence before any telemetry or automatic upload is considered.

Exit gate: Complete. A user can explain why a unit compiled, fell back, or failed; reproduce the same decision from integrity-bound evidence; compare optional semantic-only IR; audit cache, dependency, ABI, fallback, and provider decisions; and map build/runtime failures back to authored source without reverse-engineering generated C# or exposing source, secrets, or machine paths.

Milestone 18 — Establish versioned semantic oracles

This correctness gate strengthens both built-in and external-provider semantic paths without copying PowerShell's compiler architecture.

Exit gate: Complete within the promoted Windows profiles. Named profiles govern target identity, binding/lowering, providers, caches, artifacts, diagnostics, compatible #requires, and every promoted semantic family. Schema-3 observations integrity-bind exact executable/runtime identity, reject contradictory or unbounded evidence, preserve ordered values/cardinality/streams/errors/state and original property order, explicitly distinguish selected-property AutomationNull from ordinary null before binding collapse, consume the versioned framed Strict protocol for nullable, multiline string, and culture-sensitive values, and record direct OS-observed child-process launches/exits with ordered invocation identity. The earlier pin set produced 93 interpreted observations across Windows PowerShell 5.1, PowerShell 7.4.19, and PowerShell 7.6.5, with artifact-hash-bound Strict-executable evidence for all 24 promoted runtime-free cases against 7.6.5. This release review reran all 31 interpreted cases on the newly pinned 7.4.20 and 7.6.6 hosts; the previous Windows PowerShell 5.1 and Strict evidence remains historical. The direct process case was previously exercised against the earlier three exact pins, and upstream patch changes produce review-only evidence without changing a pin.

Milestone 19 — Qualify real dependency and interop ecosystems

This milestone consumes the Milestone 16 executable-provider/trust boundary for external Strict adapters. Hosted Hybrid fixture work may continue earlier, but it must be reported as PowerShell-hosted compatibility rather than runtime-free provider execution.

Exit gate: Partial at one authorized external boundary. The complete typed CIM/MI and LDAP operation families execute through compiler-generated Strict artifacts without a PowerShell runtime. The release-wired management package carries three exact managed assemblies and one parsed, architecture-checked native bridge; the release-wired directory package carries its exact adapter and LDAP protocol assembly plus the reviewed Windows LDAP ABI. Both packages flow through lock, provenance, SBOM, publication disposition, native-import closure, and delivered-closure verification. Management proves local/remote operation, reusable caller-session ownership, bounded results, failure, cancellation, disconnect, and cleanup. Directory qualification proves the explicitly advertised win-x64 LDAP/Negotiate profile, read-only integrated access, bounded paging-state release, reusable provider-created sessions, every mutation operation, true/false compare, rename, deletion, and verified cleanup in a caller-declared test location. ABI 5 confines synchronous initialization to a deadline-bound child process and terminates its tree on timeout or cancellation; the direct in-process adapter remains honestly post-initialization cooperative. Unqualified LDAP transport/authentication modes and arbitrary caller-created connections fail closed instead of inheriting credit from the proven profile. WMI v1, CDXML, and arbitrary directory cmdlets remain explicit hosted/profile contracts rather than automatic translation. Completion now requires only the authorized reboot/reconnect exercise on a disposable Windows management target; it is not inferred from metadata or replaced by rebooting an ambient runner.

Milestone 20 — Establish generic measurement and expand useful coverage continuously

Milestone 13 proved the mechanism. This milestone turns it into a maintained compatibility program without making Evotec modules or any public product into compiler intrinsics.

Exit gate: Complete within the fixed bounded packets. Ten unrelated public modules pass baseline-gated clean-target Hybrid build/import/invocation. Of 735 authored units, two are emitted as compiled cmdlets, 733 remain safely retained/runtime-routed, and 13 terminal typed regions are promoted inside retained Pester functions without being counted as emitted units. The exact external benefit packet invokes 4/4 emitted commands from four unrelated workloads across three scenario families with original/generated parity. Four Strict programs totaling 18 emitted units execute on win-x64 and linux-x64; the four-file/11-method application additionally consumes a hash-verified delivered resource, proves its four-source-file reviewed dependency closure, exact success streams, and bounded failure contract, then records six alternating fresh-process samples after one excluded warmup per surface. The checked-in per-RID baseline enforces those identities, hashes, exits, sampling rules, and conservative timing budgets. In the final combined Windows packet its compiled median was 101 ms versus 790 ms through pwsh; the pinned-SDK Linux replay recorded 26 ms versus 233 ms. Those timings are packet evidence, not universal performance promises.

Frontier snapshot on 2026-09-01: the separate seven-workload packet acquired and analyzed 155 source files with zero parser-error files. Profile-compatible #requires, nullable CLR value-member reads, stable scalar stream-message interpolation, adjacent control-flow closure, the additional immutable utility workload, and Boolean command discovery raise post-emission coverage to 5/196 units (2.55%) and 5/183 functions (2.73%). The exact baseline enforces that result. Generated binary modules bind Get-Command only when one name plus -ErrorAction Ignore or SilentlyContinue is consumed as a Boolean availability test. The provider routes a constant, argument-bound script through the canonical hosted-command capture delegate so the current PowerShell host retains exact-name autoload, module qualification, wildcard matching, and the different $Error effects of Ignore and SilentlyContinue. It records that hosted contract and remains unavailable to Strict runtime-free targets; general CommandInfo output and wider parameters still fail closed. This raises typed CLR emission by one unit/function but does not reduce the runtime-fallback count because the emitted method intentionally retains one hosted boundary. Bounded local begin/process/end lifecycle calls accept an exact one-dimensional stable-scalar array literal, local, or parameter. A null typed array supplies one process record after exact by-value parameter conversion, an empty array supplies zero, and begin/end each run once per invocation; types with binding-error null semantics fail closed. The lifecycle binder also accepts homogeneous stable-scalar success output at top level or inside nested if/elseif/else branches in process, materializes the records actually selected plus the terminal end record in authored order, and exposes the result through a typed collection ABI. The output-producing slice is proven against Windows PowerShell 5.1, then-pinned PowerShell 7.4.19 and 7.6.5, and runtime-free .NET 8/.NET 10 artifacts. Output-producing begin, loop/switch/try-nested process output, heterogeneous or array-valued process output, process return/break/continue control flow, and wider pipeline shapes still fail closed. Generated binary-module hosts now preserve an untyped parameter as an object-valued binding contract behind a dedicated capability; Strict runtime-free entry points still reject it, and dynamic member or invoke-member behavior remains unsupported. This generic slice removes the previous 32 parameter.type occurrences across 23 units and five workloads, but none was a visible sole blocker. Complete-workload execution remains 0/7 because the assessment lane is census-only; the separate opt-in qualification builds exact acquired inputs and proves 4/4 selected emitted commands across three scenario families without claiming a complete workload. The strongest cross-workload gaps remain runtime scope, bound pipeline syntax, untyped member/invoke-member expressions, broader pipeline lifecycle, missing lowering, remaining parameter contracts, and additional common command-provider shapes. Coverage work must address those semantic families generically and then pass the oracle, fallback, artifact, dependency, and target-profile gates before each baseline refresh.

The 2026-09-02 hosted-Boolean packet adds a dedicated command-family binder, bound node, lowering node, provider collector, boundary counter, and command-agnostic backend renderer. Its initial Test-Path contract accepts only LiteralPath/PSPath expressions proven to begin with FileSystem::, mandatory literal ErrorAction Ignore, optional literal PathType, and optional IsValid. Generated binary modules invoke canonical Microsoft.PowerShell.Management\Test-Path through the existing capture delegate, preserving FileSystem-provider, literal-path, path-type, and host-version behavior without approximating it with System.IO. Real net472/Windows PowerShell 5.1 and net8/PowerShell 7 binary modules match source behavior for missing and existing paths, literal wildcard text, leaf/container tests, validity tests, and the neutralized error-variable surface. The binder rejects unqualified or other-provider paths, Path wildcard semantics, omitted or wider error policy, the PowerShell 7-only LP alias, basic functions, runtime-free targets, arrays, coercive paths, dynamic path types, redirection, and wider parameters. Generic walkers now carry nested runtime-state and stream-message expressions through host requirements, bound-parameter requirements, providers, call graphs, and exact boundary counts. The fixed packet remains 5/196 emitted units and 5/183 emitted functions with zero regressions, and command.test-path remains one visible sole blocker; the safe slice closes an architecture and executable-semantics gap without claiming a corpus-emission gain.

The 2026-09-02 delegate packet adds one capture-free script-block contract for exact CLR callback members. The target must be a closed, target-reference-compatible delegate returning Boolean; the script block may omit parameters or declare exactly the target arity using simple untyped, unqualified, writable names, and its complete undecorated body must be one constant $true/$false expression or return. Binding records the exact delegate and parameter types in bound IR, lowering has no PowerShell AST dependency, and target-typed C# emission preserves framework nullable annotations for trim and NativeAOT builds. Captures, computed results, typed/defaulted/scoped/read-only parameters, extra statements, redirection, background execution, lifecycle blocks, non-Boolean delegates, by-reference signatures, and general closures remain fallback or rejection. Target-reference member matching now uses structural generic signatures and separately proves read versus write access, preventing a compiler-host setter from authorizing a target that exposes only a getter. Source and generated binary modules match on net472/Windows PowerShell 5.1 and net8/PowerShell 7; runtime-free net8/net10 libraries and a real win-x64 NativeAOT executable also invoke and verify the accepted callback. Hybrid compiles the bounded callback while retaining captured or otherwise rejected callbacks in source. The fixed external packet remains 5/196 emitted units and 5/183 emitted functions with zero regressions because the affected administration function has several independent control-flow, command, object, and error-semantics blockers.

The conditional lifecycle expansion changes no unit or function in the fixed external packet because those lifecycle units have additional unsupported shapes. It closes a standalone semantic and artifact-proof gap; it is not counted as a corpus-coverage gain.

Direct static CLR assignment now follows the same canonical member binder, bound IR, lowering, target-reference, and backend path as instance member assignment. It accepts only simple = against one public, unambiguous, target-compatible writable static property or non-literal, non-readonly static field. Compound assignment, dynamic or nonlocal receivers, ambiguous targets, and property assignment whose failure would be observed by a RuntimeException catch remain hosted or rejected. The canonical assignment-target oracle was expanded without adding a second assignment case; the promoted runtime-free subset retains runtime-free evidence. The selected affected external workload now reaches its next unsupported typed error-record construction boundary, so the fixed packet remains 5/196 emitted units and 5/183 emitted functions. This is a generic semantic closure with no claimed corpus-coverage gain.

Generated binary modules now also preserve language foreach over an authored [array]/System.Array parameter. The canonical binder assigns each element the existing object-valued host contract, bound and lowered IR record the general-array shape, and the backend enumerates the CLR System.Array without inspecting PowerShell syntax. Null and empty arrays produce no iterations, scalar parameter binding produces one, and heterogeneous and multidimensional arrays preserve their CLR enumeration cardinality. Strict executable entry points, untyped member access, and dynamic invocation remain unsupported. The current 31-case/93-observation exact-host matrix and real net472/net10 binary modules prove the contract. The two fixed-packet units that previously stopped at the foreach variable now expose hosted command-result typing/provider blockers, so measured emission honestly remains 5/196 units and 5/183 functions.

Null-seeded reference locals now use one conservative whole-function inference rule: the first assignment must be $null, every later concrete assignment must resolve to the same exact reference type, and mixed, unknown, value-type, or compound-assignment flows fail closed. Exact CLR type and definite value state remain separate: cloned optional branch, loop, switch/try, and lifecycle process paths merge null state conservatively before later member binding. Potentially null Length reads whose concrete result is not Int32 fail closed because PowerShell's null result is an Int32 zero. Contextual null binding then preserves eligible reference types through the existing mutation IR and C# backend. Real net472/net10 binary modules prove null, constructed, optional-branch, and zero-iteration loop paths plus deterministic cleanup; generated lifecycle evidence proves the zero-record path retains null propagation, and the current 31-case/93-observation exact-host matrix records the interpreted contract. The two fixed-packet units that previously stopped at object-to-handler type changes now reach their next delegate-property boundary, so measured emission remains 5/196 units and 5/183 functions with zero regressions.

Scalar numeric comparison follows one bounded left-directed conversion rule: when the right integral operand can widen exactly through a CLR-safe conversion to the left integral operand's static type, the binder records that conversion in bound IR before lowering. Nullable integral and decimal equality use the corresponding lifted equality. Nullable integral and decimal relational comparisons now use four explicit null-ordered bound operators; the binder normalizes one exact underlying type, lowering allocates two temporaries, and the backend evaluates each authored operand once before applying PowerShell's rule that negative numbers sort below null while zero and positive numbers sort above it. Both-null inclusive comparisons are true and strict comparisons are false. Nullable floating equality and ordering, precision-changing promotion, narrowing, nullable-right widening, arrays, and dynamic coercion remain rejected. Real net472/net8 binary modules match Windows PowerShell 5.1 and PowerShell 7 for signed integral, unsigned integral, and decimal null ordering, and the dedicated runtime-free case passes the complete 31-case/93-observation exact-host matrix plus the 24-case Strict subset against the earlier PowerShell 7.6.5 pin. The fixed external packet remains 5/196 emitted units and 5/183 emitted functions with zero regressions; this closes a generic semantic contract without inventing a corpus-coverage gain. The frontier classifier still evaluates assignment mutation and CLR-member diagnostics before generic validation wording, preventing either category from being mislabeled as parameter metadata while preserving assignment.target for member mutation.

Post-test do/while and do/until now share the canonical loop binder, bound IR, definite-assignment pass, optimizer, lowering, and backend. The body executes before the condition, continue transfers to the post-test condition, break exits the loop, and until negates the authored Boolean condition at lowering. A first-iteration assignment is available to the condition and loop exit only when branch merging proves it and no break, continue, return, or throw can bypass that flow; transfer-heavy bodies retain conservative state. Constant post-test loops remain represented as loops so an optimizer cannot hoist loop-control statements outside their valid target. Real net472/net8 binary modules match Windows PowerShell 5.1 and PowerShell 7 for zero- and above-threshold starts, body-first assignment, continue, break, and constant-condition execution; labeled loop control still fails closed. A dedicated post-test-loop semantic family, native case, upstream provenance, and exact host pins expand the canonical matrix to 27 cases and 81 interpreted observations and the promoted runtime-free subset to 21 cases. The fixed external packet contains five post-test syntax occurrences, but those units retain additional dynamic pipeline, scope, member, or provider blockers, so this generic closure does not claim an emission increase.

Short-circuit logical binding now clones symbol state only for the right operand and marks one direct reference variable non-null when reaching that operand proves it: $null -ne $value under -and, or $null -eq $value under -or, including the safe reversed form only for a PowerShell-scalar string or a statically sealed non-enumerable scalar. Null equality has an explicit bound operator and emits Object.ReferenceEquals, so user-defined C# equality cannot manufacture a non-null proof. Collection-left values, unsealed reference types, enumerable value types including nullable wrappers, opposite predicates, and wider/dynamic conditions do not refine the right operand. They remain hosted or rejected unless the complete right-hand expression has an independent bounded contract; nullable integral/decimal member comparisons now provide one such runtime-free path for opposite predicates without manufacturing non-null state. Runtime-free libraries execute null, positive, zero, reversed, -and, and -or paths across net472/net8/net10; the 31-case/93-observation exact-host matrix and 24-case Strict subset include a dedicated minimized case. The fixed external packet retains the non-null refinement and now clears that unit's construction diagnostic too, but independent blockers keep measured emission at 5/196 units and 5/183 functions with zero regressions.

Bounded New-Object CLR construction now resolves through one compiler-owned command-family contract and normalizes into the same exact constructor selection, bound invocation IR, lowering, and C# backend used by [Type]::new(...). The accepted shape requires a literal TypeName, no redirection or splatting, and either no arguments, one closed scalar literal, or one parenthesized list of closed scalar literals; module qualification and the documented Args alias are accepted. Property, ComObject, Strict, dynamic type names, variable or splatted argument lists, nested/empty arrays, array-as-one-argument ambiguity, unsupported target types, non-exact overloads, and runtime-error wrapping remain hosted or rejected. Cross-target net472/net8/net10 libraries, the 31-case/93-observation exact-host matrix, and the 24-case Strict subset prove the bounded contract. The safe literal slice removes 9 of the former 25 command.new-object occurrences; 16 wider occurrences remain across four external workloads instead of being misclassified as runtime-free. Independent runtime-scope, lifecycle, pipeline, parameter, filesystem/provider, and member blockers keep the honest packet at 5/196 emitted units and 5/183 emitted functions.

Exact System.Diagnostics.CodeAnalysis.SuppressMessageAttribute declarations now have one compile-time-only metadata owner shared by structural analysis and semantic validation. The bounded shape requires the real framework attribute on a script or function parameter block, exactly two literal string constructor arguments, and only literal Justification, MessageId, Scope, or Target properties; it is deliberately omitted from the runtime ABI. Dynamic or malformed arguments, unknown or repeated properties, parameter-level placement, and unresolved lookalikes fail closed. A real Strict executable and the existing parameter-metadata oracle prove that suppressions do not change execution or output. The fixed external packet drops from 45 to 34 parameter.metadata occurrences and from 38 to 31 affected units while staying at 5/196 emitted units and 5/183 emitted functions with zero regressions, so this is a generic semantic closure rather than a claimed coverage increase.

Standalone [void] expression now binds as a statement-level discard rather than a general conversion to System.Void. The accepted shape is exactly one single-element statement pipeline whose operand already has a typed contract; return, assignment, expression-container, multi-stage pipeline, and unsupported-operand forms still fail closed. The binder preserves operand evaluation, lowering carries explicit discard intent, and one collision-free generic backend helper owns both [void] and value-returning $null = expression without emitting success output. Bare values, nested control flow, side-effecting member calls, net472/net8/net10 artifacts, Windows PowerShell 5.1, pinned PowerShell 7.4/7.6, and the complete 31-case/93-observation matrix prove the boundary. The fixed external packet removes one of six expression.conversion occurrences and one of six affected units while remaining at 5/196 emitted units and 5/183 emitted functions with zero regressions; independent blockers prevent an emission increase.

Exact static enum-member parameter defaults now use the canonical target-typed literal owner rather than evaluating a general PowerShell expression. The enum type must exactly match the parameter's enum or nullable-enum type, optional parentheses may contain only the single member expression, and one case-insensitive public literal member must resolve from the selected target framework's reference metadata. Its target-metadata value becomes the portable numeric ABI, so a member available only to the compiler's newer host framework fails closed for an older target. Mismatched types, missing members, non-enum static properties, method calls, and wider runtime defaults remain fallback. Generated binary-cmdlet omitted/explicit behavior, explicit net472 rejection of a newer-only member, net472/net8/net10 runtime-free libraries, Windows PowerShell 5.1, pinned PowerShell 7.4/7.6, and the complete 31-case/93-observation matrix prove the boundary. The fixed external packet drops from 8 to 6 parameter.default occurrences, from 7 to 5 affected units, and from 4 to 3 affected workloads while staying at 5/196 emitted units and 5/183 emitted functions with zero regressions; independent blockers still prevent an emission increase.

The exact read-only $ExecutionContext.SessionState.LanguageMode chain now uses the existing runtime-state classification, bound/lowered IR, and binary-host state dictionary. Generated cmdlets capture the live PSLanguageMode at invocation; no profile label or build-time snapshot substitutes for session state. Assignment, locally defined $ExecutionContext, other execution-context/session-state members, and runtime-free targets fail closed. Real net472/Windows PowerShell 5.1, net8/then-pinned PowerShell 7.4.19, and net10/then-pinned PowerShell 7.6.5 binary modules plus the expanded 31-case/93-observation exact-host matrix prove the boundary. The fixed external packet moves one unit from runtime.scope to its independent enum/string comparison blocker: runtime-scope occurrences fall from 192 to 191, affected units from 56 to 55, and visible sole blockers from 5 to 4, while emission stays at 5/196 units and 5/183 functions with zero regressions.

Hosted binary modules now preserve scalar enum-left/string-right equality for -eq, -ne, -ceq, and -cne through PowerShell's public LanguagePrimitives.Equals contract. The bound operator owns the required language-runtime capability, so optimizer reconstruction cannot silently turn hosted semantics into a runtime-free claim. Reverse operand order, relational operators, arrays, and object-typed right operands remain rejected or hosted. Real net472/Windows PowerShell 5.1, net8/PowerShell 7, then-pinned PowerShell 7.4.19 and 7.6.5 execution, and the complete 31-case/93-observation matrix cover case-insensitive, case-sensitive, numeric-text, invalid-text, and inequality behavior. The fixed external packet remains at 5/196 emitted units and 5/183 emitted functions with zero regressions; syntax.unsupported falls from 106 to 105 occurrences, from 40 to 39 affected units, and from 6 to 5 visible sole blockers, but the affected function still has an independent hosted command boundary.

PowerShell's adapted Count member on a statically array-typed value now resolves in the canonical CLR member binder to total CLR Length, using the existing null-to-zero receiver contract. The bounded slice covers [array]/System.Array, concrete one-dimensional array types, case-insensitive member spelling, null and empty inputs, and multidimensional values received through the supported System.Array ABI; dynamic object receivers and explicitly multidimensional parameter types outside the current target policy still fail closed. Runtime-free libraries targeting net472, net8, and net10 build and execute in the .NET 10 validation process, the modified semantic case passes the complete 31-case/93-observation exact-host matrix, and its Strict artifact remains identical to the earlier pinned PowerShell 7.6.5 result. The public acceptance packet remains green at 10/10 unrelated modules and 4/4 Strict programs. The fixed external packet remains at 5/196 emitted units and 5/183 emitted functions with zero regressions, and its measured syntax.memberexpression frontier remains 15 occurrences across 11 units because the counted sites are outside this statically array-typed slice. No workload identity or input-specific rule participates in eligibility.

Bounded hosted Boolean commands now have one command-family IR path rather than command-name logic in the emitter. The initial Test-Path provider accepts only LiteralPath/PSPath expressions proven to begin with FileSystem::, mandatory literal ErrorAction Ignore, optional literal PathType, and optional IsValid. It routes the canonical module-qualified command plus bound values through the existing PowerShell capture delegate, preserving FileSystem-provider, literal-path, path-type, and host-version behavior inside that bounded, error-neutralized contract. The backend renders only the lowered provider contract and arguments. Real net472 and net8 generated binary modules match their source hosts. Other providers, unqualified paths, Path wildcard semantics, omitted or wider error policy, the PowerShell 7-only LP alias, basic functions, Strict runtime-free artifacts, and array, coercive, redirected, or wider command shapes fail closed. Completed generic traversal covers nested runtime-state and stream-message expressions for host delegates, bound parameters, call graphs, provider evidence, and boundary counts. The fixed packet remains 5/196 units and 5/183 functions with zero regressions, while the one visible sole command.test-path blocker remains outside the safe slice.

No-argument Get-Date now resolves through a compiler-owned runtime-state command provider and the canonical parser → binder → bound IR → lowering → backend route. The exact accepted shape has no positional or named arguments, splatting, invocation operator, or redirection; it produces one System.DateTime by reading System.DateTime.Now at runtime, so the result remains local-time DateTime state and is never folded into the build. The provider is runtime-free, AOT-compatible, dependency-free, recorded in emitted method and artifact evidence, and closed to package or direct-extension registration. Formatting, authored dates, Unix formatting, wider parameters, aliases, and other command forms remain fallback or rejection. Strict net472/net8/net10 libraries, a real win-x64 Strict NativeAOT publish/run, and real net472/Windows PowerShell 5.1 plus net8/PowerShell 7 binary modules prove the bounded contract. The public acceptance packet remains green at 10/10 unrelated modules and 4/4 Strict programs. The fixed external packet removes all seven former command.get-date occurrences across three affected units but remains at 5/196 emitted units and 5/183 functions with zero regressions because those units retain independent blockers.

Command-resolution closure now has one semantic owner rather than separate name guesses in inference, command islands, and provider binding. The provider registry catalogs identities; one resolver applies authored local-function precedence and target-host disposition, and analyzer/explain, inference, binding, Hybrid, Strict, and provider evidence consume it. Generated PowerShell hosts lower a provider only from its canonical Module\Command source identity. Unqualified commands preserve PowerShell's local, required/imported-module, alias, and caller-session lookup through a hosted or retained source path; Hybrid remains compatible and Strict fails closed when fallback is required. Closed runtime-free artifacts may use an unqualified registered provider after local-shadow exclusion. The real built-in ownership split (Microsoft.PowerShell.Core for Where-Object/ForEach-Object; Microsoft.PowerShell.Utility for Select-Object/Sort-Object and the current utility providers) is now test-locked. Direct return, typed assignment, untyped assignment, local shadow, required-module shadow, caller-session shadow, module-qualified success, module-qualified alias deferral, Hybrid fallback, Strict rejection, PS5.1/net472, PS7/net8, and runtime-free artifact tests cover the decision matrix. This closes the duplicate-resolution-brain defect; it does not broaden the supported command set.

The reviewed external baseline was intentionally lowered from 9/196 to 5/196 emitted units and from 9/183 to 5/183 emitted functions when this closure landed. Locksmith2 moved from four emitted functions to one and the Scoop installer from two to one because their additional candidates depended on unqualified host commands whose exact PowerShell command identity had not been proven. Recovering those four units by restoring registry-first name matching is forbidden; future gains must use canonical qualification, a closed runtime-free intrinsic, or another explicit semantic boundary with exact-host evidence. The refreshed census passes 7/7 with zero regressions, the execution qualification remains 4/4 across four unrelated workloads, and the public packet remains 10/10 Hybrid modules plus 4/4 Strict programs.

Explicit local-function positions now bind through the existing local-call signature, bound invocation, lowering, and backend path. The binder orders declared [Parameter(Position = n)] slots by numeric position rather than declaration order, treats parameters without an explicit position as named-only once any explicit slot exists, skips already named slots, preserves authored argument-evaluation order, and honors explicit positions even when CmdletBinding(PositionalBinding = $false) disables only implicit positioning. Sparse numeric positions therefore describe order without requiring gap arguments. Named parameter sets, duplicate/invalid position metadata, and surplus positional arguments remain fail-closed through the existing validators and local-call diagnostics. The parameter-binding semantic oracle, net472/net8/net10 runtime-free artifacts, net472/Windows PowerShell 5.1 and net10/PowerShell 7 Hybrid differential execution, and explicit negative tests cover the boundary. The fixed external packet removes all 10 former parameter.binding occurrences across five units, including its one visible sole blocker, but that function advances to the independent binary-module.cmdlet-shape gate; measured emission remains 5/196 units and 5/183 functions. The final ledger continues to report that analyzer-eligible shaped fallback and its cause. Census products and external baseline schema 2 now carry the stable final-ledger identity and disposition of every authored function. Comparison fails closed when a previously eligible or emitted function regresses, when a function newly becomes runtime-routed, when a previously eligible function newly becomes shaping fallback, or when identities are missing or duplicated; aggregate equality therefore cannot conceal replacement of one emitted function by another. A previously ineligible runtime-routed function may advance to an explicitly attributed shaping fallback without being mislabeled as loss. Source identity, parser health, emitted minima, and fallback maxima remain independent gates. This keeps semantic progress visible without hiding artifact-stage loss or creating a second eligibility authority.

Stable scalar defaults for authored [array]/System.Array parameters now use the canonical target-typed literal contract. PowerShell's compile-time conversion produces one object[] element for a scalar default such as 'All'; the portable literal ABI records the array and its stable element type, and the parameter prologue preserves PowerShell's distinction between an omitted default and explicitly bound input. Validation applies only to the latter, so an intentional out-of-set sentinel default remains valid while the same explicitly supplied value fails. Authored collection expressions, authored conversions that would preserve another runtime type, general System.Array conversion expressions, dynamic expressions, nested arrays, and non-encodable elements still fail closed. Numeric spellings proved unavailable to the selected host profile are promoted to file-level parse failures in Package, Hybrid, and Strict, because retained source would not be a viable fallback on that host. The bounded numeric gate is shared with literal lowering and does not claim complete historical-parser emulation. Runtime-free net472/net8/net10 libraries preserve and deserialize the nested ABI, omitted sentinel defaults, explicit empty arrays, and explicit validation failure; real net472/Windows PowerShell 5.1 and net10/PowerShell 7 binary modules match the same source behavior. The fixed external packet remains at 5/196 emitted units and 5/183 functions with zero regressions; its post-emission function frontier still contains two unrelated parameter.default occurrences, so no corpus emission gain is claimed for this slice.

The 2026-09-03 live-module-state slice raises the exact external assessment to 6/196 emitted units (3.06%) and 6/183 emitted functions (3.28%) with zero parser errors or baseline regressions. The newly emitted function is Locksmith2/Public/Get-LS2Stores.ps1; this is evidence that the generic $script: contract unlocked a real administration function, not a compiler rule for that workload. Its emitted method is still reported as runtime-routed because each read crosses into the retained parent script-module scope. The gain therefore means more typed CLR surface, not runtime independence or measured acceleration. Complete-workload execution remains 0/7 in this census-only lane.

The 2026-09-03 write slice accepts only direct untyped $script:<safe-identifier> = <typed-value> statements in Hybrid modules. It emits a distinct write-bound IR statement and writer ABI, preserves the parent script scope as the only value owner, and propagates read and write authority independently through compiled local calls. The assignment value still traverses the canonical semantic expression tree, so bound-parameter presence, runtime state, hosted commands, provider cancellation, streams, and nested local-call requirements cannot disappear merely because the expression is a module-state write. Scope-bound writers preserve null, scalar, array, and object identity/cardinality plus case-insensitive variable names and the native VariableNotWritable error for Constant and ReadOnly variables on Windows PowerShell 5.1 and PowerShell 7. The generated bridge rethrows the original exception through the compiled body, allowing an authored compatible catch to handle it, and converts only an unhandled tracked state error back to its original ErrorRecord at the cmdlet boundary. The focused state cluster passes 21/21 on Windows and 21/21 on the native Linux net10.0/PowerShell 7 lane with SDK 10.0.303. Normal removal and failed initialization clear writer registrations. Ledger schema 2, IR snapshot schema 2, and explanation schema 3 record read and write crossings independently; the prior public ledger constructor remains available and JSON round trips preserve the new fields. Compound assignment, increment/decrement, typed targets, unsafe/dynamic names, and member/index mutation still fall back. The exact online and offline external packet remains 6/196 units and 6/183 functions with zero regressions: the new contract closes a common state boundary but no additional function clears all of its independent blockers, so this slice claims semantic reach rather than an emission increase.

The 2026-09-04 typed-access slice permits a member or index read only when the authored expression itself converts one safe live $script: variable to an exact supported CLR receiver type, such as ([string]$script:Name).Length or ([string[]]$script:Items)[0]. The runtime-state binder still owns the read, the existing conversion and CLR member/index binders own the operation, and the ordinary bound IR, lowering, and backend path emits it; no declaration scan, retained-initializer inference, ETS dispatcher, or AST-to-C# path was added. One canonical module-state-origin fact follows the bound value through conversions, local assignments, success output, and local-call results. Member/index/invocation, loop, pipeline, and lifecycle consumers fail closed unless the receiver is the exact permitted direct conversion; object/ETS receivers, nested conversions, state-derived locals, call arguments/results, and method calls therefore cannot widen the boundary. Hosted command regions and captures consult that same origin before projecting arguments and fall back the enclosing function when an input is state-derived, so a hosted command or retained lifecycle cannot launder the value back into dynamic ETS access. Index reads allocate collision-free target and key temporaries so both evaluate exactly once and in authored order. The review closure also corrected indexed mutation globally: lowering now captures RHS, target, and key exactly once in PowerShell's RHS-first order, including before null or bounds failures, while hosted array/list failures retain their effective IndexOutOfRangeException/ArgumentOutOfRangeException, FQID, and OperationStopped category and null arrays retain NullArray. Real artifacts match Windows PowerShell 5.1 and PowerShell 7 for these access, order, typed-catch, and failure-identity cases. Member/index mutation of live module-state-derived objects and every Strict parent-module-state use remain fallback or fail closed. The portable corpus remains 8/8 emitted functions, and the exact offline external packet remains 6/196 emitted units and 6/183 emitted functions with zero regressions. The packet contains typed state declarations but no function cleared through this exact authored-cast access contract, so this is a proven semantic expansion rather than an aggregate emission claim.

The 2026-09-04 terminal-region slice is the first partial-function promotion through that same compiler. The refreshed public packet builds, imports, and invokes 10/10 modules and executes 4/4 Strict programs; it records 13 promoted regions inside retained Pester functions, two already-existing full compiled cmdlets, and 733/735 runtime-routed units. A control run at the pre-slice head confirmed that the two full PSFramework cmdlets were already emitted, so the refreshed baseline does not attribute them to region promotion. The refreshed external assessment remains 6/196 emitted units and 6/183 emitted functions, adds two promoted regions in Locksmith2 (Test-IssueExists and Show-ConnectionContext), reports zero parser errors and zero regressions, and still performs 0/7 complete-workload executions. These 15 regions are coverage-discovery evidence, not yet proof of useful acceleration: the public probes do not isolate the promoted Pester functions, the external assessment is census-only, and no cross-family performance result has been recorded.

Milestone 21 — Productize project, lock, restore, and package UX

This is the toolchain/ecosystem part of “Python territory”: users need a reproducible environment and artifact workflow, not only a compiler API.

Exit gate: Partial / local workflow complete. From a clean project, the generic CLI restores the exact reviewed environment online or offline, authenticates package archives and extracted payloads, consumes the target closure lock during generated compilation, applies the selected semantic profile, analyzes, recommends, builds, tests, packs, installs by complete target/artifact-set identity, and diagnoses drift without repository-specific resolution. Only public publish/install/upgrade/rollback proof remains open and unauthorized.

Milestone 22 — Broaden platform and profile-guided performance maturity

Add target-host execution lanes for the next explicitly selected Windows, Linux, and macOS x64/Arm64 profiles. Support is promoted one RID/deployment profile at a time; cross-publish remains experimental.
Isolate native-Linux compiler validation in its own checkout and intermediate-output tree, and classify every test by real host capability. The current command-resolution/artifact matrix passes 20/20 under Linux with exact SDK 10.0.303 plus the net8 targeting pack, and Windows-only CIM/WMI/CDXML/COM/process fixtures now use the shared WindowsFact gate. The aggregate compiler category is not yet a valid native-Linux gate because older external-wrapper, Authenticode, net472, and Windows PowerShell oracle tests still invoke Windows-only APIs or cross-host executables; do not report those environment failures as compiler regressions or repeat the earlier blanket full-suite claim at a new head.
Pin and exercise one supported SDK-selection path for build, test, MSBuild task-host, and benchmark evidence. SDK 10.0.303 is selected with roll-forward disabled; the normal solution, compiler/project workflow, generated MSBuild, and recorded ReadyToRun benchmark paths consume that selection rather than an ambient preview or dotnet exec workaround.
Turn Hybrid boundary profiling into an opt-in recommendation workflow that identifies hot eligible regions, crossing cost, and coarse-boundary candidates without changing source or artifact mode automatically.
Add further immutable IR rewrites, allocation reduction, pipeline fusion, loop specialization, conversion caching, and mapping only when a named corpus/benchmark exposes a cost and semantic/source-map proof remains intact.
Evaluate ReadyToRun, trimming, NativeAOT, composite artifacts, and profile-guided optimization per scenario. Do not treat one backend as universally faster or smaller.
Keep readable generated C# as the canonical lowering. Consider a direct IL/native backend only if measured Roslyn/MSBuild/code-generation limits block an accepted product requirement and the new backend consumes the same lowered IR, source maps, ABI, and evidence contracts.
Add cold/warm startup, throughput, allocation, working-set, boundary, build-time, artifact-size, import, and clean-target execution budgets for the public packet. Record regressions separately from language-coverage changes.
Define the support matrix, preview/stable channels, security and compatibility response policy, release cadence, and downstream pilot evidence required before a 1.0-quality claim.

Exit gate: Partial. The support matrix advertises only the already target-proven win-x64 and linux-x64 Strict profiles, keeps macOS/Arm64 and additional deployment profiles experimental, and exposes measured opt-in recommendations plus explicit performance budgets. The Strict Linux artifact/profile proof remains valid, but the broader native-Linux test harness still needs the capability partition above before it can become an aggregate release gate. Physical macOS/Arm64 promotion and a stable-channel release remain separate qualification work.

Milestone 23 — Compile module-scale state and regions without a second runtime

This is the coverage milestone after the current corrective gate above. Hybrid must preserve one live PowerShell module and accelerate proven code around it; Strict must not inherit credit from that hosted state. Analysis-only discovery can continue while the accepted-code defects are corrected.

Exit gate: Complete for bounded M24–M26 contracts. The continuation implements guarded prefixes, approved regions selected from non-overlapping canonical runs, schema-6 transfer ownership including fresh stable-vector construction, bounded local collection factories, return/cardinality contracts, Hybrid-native computed members, sequential output, complete hosted multi-stage pipelines, parent-owned Hybrid state, and independent runtime-free Strict state lifetime. Dual-host matrices cover values, identity, streams, partial failure, stopping, cancellation, cleanup, and continued execution. The earlier M26 checkpoint recorded 1,060 passing compiler cases and six Strict Windows programs; the assessment records the later corrective qualification. At that checkpoint, the pinned census remained 188/282 emitted functions and 36 promoted regions because it contained no third eligible disjoint run. The assessment records subsequent workload expansion separately. Borrowed compiled reference mutation, runtime-free dynamic object/ETS access, arbitrary enumeration, computed method names, null-conditional access, and provider-bound live dependencies remain fail-closed or later work. Performance is not an admission gate.

Next implementation order

Assessment R1–R5 are closed with the recorded full-gate, corpus, focused artifact, and planning evidence. Package publication preserves prior output until commit; library/provider metadata share canonical NuGet rules; required ABI/provider families participate in recurring validation; stopping fixtures wait for the engine acknowledgment.

Complete M29 against the pinned multi-module portfolio: retain the 196/282 PSSharedGoods baseline and its qualified eight -as functions, add PowerInfoblox, another Evotec module, two independent third-party modules, and a standalone script/application. Investigate every per-function regression before refreshing a baseline. Gain at least 30 differentially executed complete functions across three module packets and four recurring blocker families, including PowerInfoblox and a third-party module; prove three module workflows and one script/application workflow. Keep Hybrid fallback, Strict rejection, and co-blockers explicit. The PSSharedGoods-only 226/282 target is a trend, not the ecosystem gate.
Integrate against current default-branch owners and run exact-candidate CI/review, including a measured compiler-gate time budget. Keep that M30 evidence distinct from local coverage qualification.
Complete M30 host-servicing, public-package upgrade/rollback, platform, and disposable-target gates. A private PowerShell API bridge needs an explicit servicing matrix and safe unsupported-host behavior; a cross-publish does not establish target execution. Generated API compatibility is separate from CLR/package binary replacement.
Run M31 measurements on qualified complete workflows, including startup, crossing, allocation, and error-path controls. Qualify interactive source debugging separately when a consumer needs it.

M24–M26 remain bounded completed foundations. Expand them only for an identified blocked workflow with explicit value/ownership/effect/lifetime contracts, original/generated artifact proof, and truthful retained boundaries. Known accepted-code defects precede breadth and optimization. See next milestones for acceptance criteria and assessment for current evidence and finding dispositions.

Keep generic Write-* stream identity, preferences, ordering, and continuation intact. Basic functions that collide with generated common parameters retain their authored surface until the wrapper contract is proved. Do not translate syntax in emitters, create product-specific compiler policy, or use a census count as proof of complete execution.

Validation and performance promotion matrix

Compiler coverage, semantic fidelity, artifact delivery, and performance are separate proof lanes. A green result in one does not substitute for another.

Lane	Compared paths	Required measurements	Promotion gate
Semantic differential	selected PowerShell host versus Strict/Hybrid artifact	output values and types, property/order/cardinality, all streams, errors, exit code, filesystem effects	Zero unexplained differences for every accepted case; unsupported cases reject or fall back exactly as declared
Pure typed compute	`pwsh -File`, Package, Hybrid region, Strict direct CLR, equivalent generated/hand C#	elapsed time, throughput, allocations, peak working set	Initial native-like target: Strict direct CLR no worse than 1.5x equivalent hand C# and at least 3x faster than PowerShell on sufficiently large eligible kernels
One-shot startup	`pwsh -File`, Package, Strict framework-dependent, self-contained, trimmed, ReadyToRun experiment, NativeAOT	cold p50/p95, warm time, working set, primary and total artifact size	NativeAOT must beat PowerShell and Package startup; claim a speed advantage over managed only when it is measured on that RID
Hosted dispatch	original function, fine generated cmdlets, coarse cmdlet/typed region, Hybrid boundary	calls per second, crossing cost, allocations	Later optimization target; semantic coverage acceptance depends on preserved behavior, not amortized crossing cost
Pipeline/object flow	interpreted and compiled high-volume transforms	elapsed time, allocations, retained memory, cardinality, ordering	Semantic parity first; optimization must reduce a measured cost without materializing duplicate pipelines
Build and artifact	clean rebuilds for each TFM/RID/profile	analysis, generation, restore/build/publish time, deterministic hashes, warnings, files/bytes	Same recorded inputs produce equivalent plans, source, ABI, and artifact set; AOT/trim warnings are zero
Module/dependency closure	script, binary, mixed, and external required-module fixtures	exact graph, lock identity, load order, artifact disposition, clean-target import/execution	No ambient-module substitution; every transitive dependency is present, explicitly external, or rejected
WMI/CIM/CDXML management	WMI v1 hosted, CIM/MI hosted and provider, CDXML metadata, local and remote Windows targets	query/method/mutation/indication behavior, object shaping, streams/errors, WS-Man/DCOM, credentials redaction, session lifetime, cancellation, cleanup	Exact named profile and target-host parity; unavailable platforms/transports or unsupported dynamic metadata fail before publication or remain explicitly hosted
Managed/native/COM interop	DLL wrapper, native/process adapter, and Windows COM fixture	TFM/RID/bitness, marshalling, lifetime, errors, cancellation, apartment/thread, deployment	The target-host artifact executes the declared contract; unsupported targets fail before publication
Platform	Windows, Linux, macOS and named x64/Arm64 RIDs	build plus execution, signals, encoding, permissions, native dependencies	A RID is supported only after execution proof on that target; cross-publish alone remains experimental

The 1.5x/3x compute figures are later optimization targets, not current semantic-support gates or universal marketing promises. They apply to pure typed kernels large enough to dominate process and command-dispatch startup. If a semantic helper misses a target, preserve its behavior and record the cost while continuing correctness and coverage work. Do not weaken semantics to hit a benchmark.

Each benchmark result records:

exact source revision and dirty-state check;
compiler/runtime/SDK versions, TFM, RID, OS, architecture, and CPU;
input size, warmup policy, sample count, run ID, and validation result;
median and tail latency where startup or services matter;
allocations, peak/retained memory, and artifact-set bytes where applicable;
generated source/ABI identity and whether execution was direct CLR, PowerShell hosted, or native.

Use BenchmarkDotNet for in-process typed kernels and a process harness for cold startup and artifact execution. Benchmark setup, validation, and artifact generation stay outside timed operations. Clean publishable runs use full jobs; dry jobs prove only discovery/setup.

Differential and adversarial proof

The semantic corpus should combine:

focused positive cases for each accepted contract;
negative cases proving precise Strict rejection and Hybrid fallback;
differential cases across PowerShell 5.1 and supported PowerShell 7 profiles where behavior is intended to match;
property-based generation within the supported grammar for operators, conversions, collections, binding, and control flow;
metamorphic cases that vary declaration order, input-file order, whitespace, line endings, path form, culture, and casing without changing the intended result;
malformed, oversized, cyclic, deeply nested, and adversarial input for parser, graph, dependency, and diagnostic robustness;
real artifact execution from a clean consumer or target host.

The compiler should fuzz parsing and binding without executing source. Crashes, hangs, nondeterministic plans, source-root escapes, unbounded diagnostic growth, and accidental acceptance are defects even when the input would not be a valid Strict program.

Feature extension checklist

Every new language feature should have:

Every new command family should normally require:

one canonical command registration;
one command-family binder;
existing bound pipeline or command nodes where possible;
an explicit unsupported-shape result rather than handler fall-through;
command, pipeline, stream, cardinality, and error differential tests;
required-module identity/version, host/runtime capability, and artifact disposition;
explicit runtime-free adapter or hosted/fallback classification;
no new command-name conditionals in an emitter.

Maintainability gates

Recorded core and extensibility/profile architecture gate

The following checklist records earlier bounded architecture qualification. Current corrective evidence is in the assessment; additional host/profile promotion retains its own M30 gates. Historical results do not override those boundaries.

The semantic compiler does not have a competing AST/emitter eligibility brain. Profiles are effective and exact-host proven for promoted families at their recorded checkpoints, the external-provider route is executable and trust-bound, corpus policy has one owner, and the fixed benefit lane invokes emitted commands across three unrelated scenario families. Remaining product work covers broader semantic families, the source-first development loop, integration, host servicing, the last external-provider exercise, physical target promotion, and public upgrade/lifecycle proof. Keep those changes in the existing owners.

Product maturity gate — Partial / development loop and distribution qualification

Broad percentage growth is useful only as a diagnostic trend. It never substitutes for these complete-program, clean-target, semantic, ecosystem, and product gates.

Retained boundary qualification checkpoint

The current compiler portfolio is 544/565 complete emitted functions and 21 retained functions. All 21 retained entries have bounded justified hosted execution evidence; this does not qualify every path in those functions. The grid proof is limited to PowerShell 7 on Windows with requested software rendering; the two dialog defaults, the dynamic-parameter form's in-memory Create/Close path, the expression form's in-memory Run/Quit path, and Trace's fixed-metadata Init/message/Quit path cover both Windows hosts. Trace preserves an authored post-Quit PropertyNotFound error. Set-PasswordRemotely has an explicit controlled native-call boundary and real initialization/refusal proof; live account changes and automatic discovery remain unqualified. Local SMB proof exercises the real authored native declaration and complete read-only local enumeration with disk-space access disabled. This checkpoint adds no compiled functions and does not close reusable runtime-created C#/native deployment translation. Exact evidence and remaining source-maintenance issues are in SupportGaps and the per-function inventory; do not substitute hosted compatibility for compilation progress.

FilesExpand file tree

PowerForge.PowerShellCompilation.Roadmap.md

Latest commit

History

PowerForge.PowerShellCompilation.Roadmap.md

File metadata and controls

PowerShell Compilation Architecture Roadmap

Product north star

Status legend

Current position

Recorded corrective gate: assignment semantics (September 7)

Corpus expansion and pilot order

Artifact ladder

Explicit target contract

PowerShell implementation as semantic evidence

End-state definition

Non-negotiable design rules

One semantic owner

No AST semantics in backends

No emitter inference

Deterministic registration

Delete migrated legacy paths

Generic compiler behavior

Artifact proof over internal proof

Generated C# before direct IL

Runtime-free means runtime-free

NativeAOT is a backend constraint

Source is data at compile time

Dependency closure is explicit

Target pipeline

Ownership boundaries

PowerForge.PowerShell

PowerForge

Runtime-free support substrate

PowerForge.Cli and PSPublishModule

Bound IR contract

Type information

Value state

Cardinality

Effects

Execution disposition

Managed CLR ABI

Semantic fidelity contract

Type acquisition and gradual compilation

Command and pipeline architecture

Stream commands

Projection commands

Pipeline transformations

General commands

Runtime-free command adapters

Module and dependency architecture

Module classification

Deterministic module resolution and restore

Binary wrappers over managed libraries

WMI, CIM, CDXML, and management-provider boundaries

Native and COM interop boundaries

Native libraries and processes

COM

Hybrid and fallback ergonomics

Hybrid executable architecture

Managed and native delivery architecture

Compiler user experience

Reproducibility, provenance, and trust

Intended source layout

Milestone summary

Milestone 0 — Freeze and inventory current contracts

Milestone 1 — Establish compiler boundaries

Milestone 2 — Implement foundational bound IR

Milestone 3 — Add deterministic analysis passes

Milestone 4 — Separate lowering from emission

Milestone 5 — Migrate all current behavior

Milestone 6 — Define runtime-free artifact contract and managed ABI

Milestone 7 — Preserve help and module contracts

2026-08-30 independent maturity reclassification and closure

Semantic pipeline migration checkpoint — Complete

Milestone 8 — Build command and pipeline semantics

Milestone 9 — Resolve modules, dependencies, and interop

Milestone 10 — Complete advanced-function lifecycle

Milestone 11 — Complete value and object flows

Milestone 12 — Expand bounded runtime state

`PowerForge.PowerShell`

`PowerForge`

`PowerForge.Cli` and PSPublishModule