Module bytecode 

Instruction set, .bf (BFV0) wire format, assembler and verifier.

Pure data plane — no threads, no mailboxes. The scheduler and VM consume Chunk values produced here.

Piece	Purpose
Opcode / Instruction	ISA (opcodes are append-only)
Value / Message	Runtime / constant-pool tags (ABI versioned)
Program / Fn	Host-side assembler with named registers
encode / decode	.bf module bytes (MAGIC + ABI_VERSION)
verify	Structural checks before a crate::Runtime starts

Current ABI: see ABI_VERSION (FlowCap + Str / Bytes).

Modules

asm_macros

Namespaced re-exports for callers who prefer an explicit path.

Structs

Cap

Authorization record stored in the runtime Cap table, never in bytecode.

CapId

Unpredictable capability token. Never a flow id.

CapRights

Fixed-width rights bitset. Keep this an explicit allow-list: every new bit here must be audited against the threat-model doc before production.

Chunk

A compiled unit of Byteflow bytecode: code, constants and the function table. One Chunk can back many concurrently-running processes — it is immutable after construction, so it is shared behind an Arc rather than copied per Flow (see byteflow-vm::Vm::chunk).

Fn

Emit instructions for one bytecode function.

FunctionDef

A callable entry point inside a Chunk: either bytecode-defined or a slot reserved for a native (Rust) function registered with the runtime via the FFI table (design notes §30-31).

Instruction

A single packed instruction word.

Label

An unresolved jump target, patched to a relative offset once its address is known (see [ChunkBuilder::bind_label]).

Message

Envelope carried in mailboxes and registers (Atomic Hop).

NativeMask

Bitset over NativeTable indices, sized once at boot to NativeTable::len(). Shared via Arc because attenuation clones the Cap far more often than it clones the mask.

Program

Assemble one bytecode module.

Reg

A virtual register in the current function.

RegWindow

Contiguous register window (e.g. four slots for make_msg natives).

RevocationCell

One revocation counter per capability issuer (a flow, the native table, the scheduler). Revoke is O(1); every derived Cap dies with it.

VerifyConfig

Knob for verify_with. Default trust is untrusted.

Enums

CapIdError

Why CapId::random could not produce a token.

CapTarget

What a capability addresses. Bytecode never sees this enum — only the opaque CapId token.

ConstantKind

Constant-pool tags that untrusted modules must not embed.

FormatError

Why a .bf buffer failed to decode.

Opcode

A single Byteflow opcode.

TrustLevel

Whether the chunk may contain authority-bearing constants.

Value

A dynamically-tagged runtime value.

VerifyError

Why a Chunk failed verification.

Constants

ABI_VERSION

Current ABI version. Bump on any breaking change to instruction encoding, constant representation, or function-table layout.

MAGIC

On-disk magic for the .bf module format (see design notes §32). Chosen so a corrupted/truncated file is rejected in the first 4 bytes rather than partway through decoding.

TAG_SYS_DOWN

Reserved Atomic Hop tag for monitor DOWN events (not an application tag).

TAG_SYS_EXIT

Reserved Atomic Hop tag for linked-exit notices.

Functions

decode

Decode a BFV0 module. Untrusted by default: Cap / Pid / Message constants are rejected (see decode_with).

decode_with

Decode with an explicit trust level. Trusted decode is for host-packed modules that may embed authority tags in the constant pool.

disassemble

Human-readable listing of a Chunk, used by byteflow-cli disasm.

encode

Encode chunk as a BFV0 module (little-endian). Pure data — no I/O.

verify

Verify structural invariants of chunk. See VerifyError for what is checked. This does not perform full dataflow/register-liveness verification (unlike, say, the JVM verifier) — v0 trades that off against implementation complexity, and instead the VM bounds-checks register indices at runtime (cheap: it’s an array index against a fixed small register file, not worth statically proving away yet).

verify_with

Like verify, with an explicit VerifyConfig.

Type Aliases

FuncId

Function index returned by Program::function.

NativeIdx

Index into a crate::NativeTable.