gooo-go-ports

# Gooo Go Ports

[Gooo](https://github.com/kimjooyoon/meta-ontology-go) is an experimental language
for describing program behavior and retaining how a program was built and run.
This repository provides independently checked Go ports and original Gooo
compositions. Start with one source change and an observable result.

## First task for a coding agent

Open this checkout in Codex, Cursor or Claude Code and ask:

> Follow `.agents/skills/gooo-first-program/SKILL.md`. Run the Gooo example,
> change its score threshold from 60 to 80, then save and replay a new execution.
> Show the actual changed result and keep my existing files.

With the supplied inputs, score `75` changes from `sensor: high` to
`sensor: low`; its other three returned fields stay unchanged. The
[first-program skill](.agents/skills/gooo-first-program/SKILL.md) and
[setup guide](docs/ai-agents.md) target Go **1.27.3** on macOS or Linux with
the compiler identity pinned by the checkout. Reuse tools only after identity
validation; [source setup](#run-and-edit-locally) may download and build them.
The [full main CI at `b0e6715`](https://github.com/kimjooyoon/gooo-go-ports/actions/runs/39544747815)
passed with Go 1.27.3 and the pinned compiler, including native comparison and
saved replay. Older immutable bundles and walkthroughs retain the toolchain
identities recorded in their own release instructions.
A source edit needs native execution. Saving generated Go alone is not a run.
For an existing Tessl setup, use the [project-local source installation](docs/ai-agents.md#install-the-skill-with-tessl)
to give the same first-program task to your coding agent.

Gemini CLI users can load the same instructions through the optional
[context extension](docs/ai-agents.md#use-the-instructions-with-gemini-cli).

If setup or execution fails, [report the first failed step and diagnostic](https://github.com/kimjooyoon/gooo-go-ports/issues/new?template=problem.yml).
An incomplete attempt is useful feedback. Share public source and inputs only.

## Choose the next useful task

| Your task | Entry | Observable result |
| --- | --- | --- |
| Assess a service-grant change | [Native first call](docs/ai-agents.md#check-a-service-grant-change-without-a-toolchain) or [MCP host setup](docs/ai-agents.md#connect-the-service-grant-mcp-tool) | Check a supported narrowing while preserving one required request; no grant is applied. |
| Preserve every required request when narrowing a grant | [Agent task skill](.agents/skills/gooo-review-service-grants/SKILL.md), [native MCP setup](docs/ai-agents.md#preserve-several-required-requests-through-mcp) or [Go API](examples/service-grant-many/README.md) | Inspect the first request that would break, with original order and all 12 Gooo decision fields. |
| Review tool exposure across a source upgrade | [Gooo catalog-change example](examples/tool-catalog-change/README.md) | Inspect added and removed selected tools under the same supplied flags and selectors, with independent Go results and saved replay. |
| Explain an unmatched deny rule | [Scoped deny-rule diagnostic](examples/deny-rule-scope/README.md) | Distinguish incomplete inventories, backend limits and earlier denials from zero matches in a declared complete surface. |
| Install the MCP tool without a compiler | [Homebrew or verified native archive](docs/ai-agents.md#connect-the-service-grant-mcp-tool) | Install the preview16 executable on macOS arm64 or Linux amd64, then assess supplied grant-change facts. |
| Run the MCP tool in an offline container | [Public image or local Docker build](docs/service-grant-container.md) | Pull the immutable Linux amd64 image, then run as a nonroot user with a read-only filesystem and no application network. |
| Edit an API policy in Gooo | [Editable policy comparison](examples/editable-api-policy/README.md) | Compare edited rules on the same facts and replay each policy. A separate opt-in compiler profile supports extracting helpers. |
| Check an API policy change in CI | [Existing policy Action](examples/api-policy-ci/README.md) | Compare the same nine facts under two sealed profiles; inspect newly denied requests and optionally fail CI. |
| Inspect fixed API decisions without a toolchain (optional) | [Native preview.11 bundles](https://github.com/kimjooyoon/gooo-go-ports/releases/tag/v0.1.0-preview.11) | Run the supplied read/write batch on Linux amd64 or macOS arm64, try synthetic copies and replay the saved comparison. This does not edit Gooo source. |
| Use Gooo from an existing Go program | [Four-file Go quickstart](https://gist.github.com/kimjooyoon/af3d75e04ac625e0e08652b8b6a07726) | Follow the frozen Go 1.27.2 quickstart; inspect input refusal, policy differences and a widening witness. |
| Edit an importing Gooo project | [Separate ETag project](templates/etag-project/README.md) | Export three source files, edit supported bodies and compare 247 supplied inputs with Go. |
| Explain a version upgrade decision | [Version eligibility](examples/version-eligibility/README.md) | Use Gooo to explain minimum-version or stable same-major update eligibility, with replayable inputs and refusal reasons. |
| Edit a patch-line update rule with Gooo 0.6.36-dev | [Experimental same-minor source example](https://gist.github.com/kimjooyoon/9ca55091bd18ddb6f06a563e99f68348#file-00-readme-md) | Compare 27 supplied cases with the original Go package and replay the Gooo results, including a 1,026-byte result declared in source. This separate example requires compiler `31497af3`; the checkout keeps its `205896a` pin. |
| Find a Go API to migrate | [Ported API table](#이식한-함수) | Check available functions, input domains and Go-to-Gooo result differences before choosing a port. |

These examples calculate bounded facts and policy decisions. Live effects still
need current host-owned authority and atomic application. Input-only `OBSERVED`
records describe finite runs; they are not expected-output verification or a
proof for all inputs. Tell us the real API or automation task you want to solve
in the [feedback form](https://github.com/kimjooyoon/gooo-go-ports/issues/new?template=problem.yml).

The [language engine](https://github.com/kimjooyoon/meta-ontology-go) owns Gooo
syntax and compiler development. This ecosystem repository owns the ports,
examples and their independent Go references.

<details>
<summary>More workflows, supported domains and verification history</summary>

**Use Gooo with a coding agent:** follow the [first-program skill](.agents/skills/gooo-first-program/SKILL.md) to edit actual Gooo source, execute it and save a replay. The [agent setup guide](docs/ai-agents.md) covers repository discovery in Codex and Cursor, explicit use in Claude Code, and the limits of the existing policy examples.

**Install the policy comparison command:** [run the immutable CLI without cloning](examples/api-policy-revision/README.md#install-the-command-without-cloning). It compares the same nine supplied facts under two fixed profiles and rechecks saved reports; this immutable installation recipe retains its Go 1.27.2 profile.

**Compare API policy decisions in CI:** [run the existing policy review](examples/api-policy-ci/README.md), whose Action pins module revision `e723f9af6dc3` and compares nine supplied facts using the [fixed original and `cel-api-readonly-v1` profiles](https://github.com/kimjooyoon/gooo-go-ports/blob/e723f9af6dc33ecfff002a951e4b09a310439338/examples/api-policy-revision/README.md). In that pinned revision, an otherwise allowed `write` changes from `ALLOW` to `ACTION_NOT_READ_ONLY`, while an allowed `read` stays unchanged; optionally fail CI on `NEWLY_DENIED`. The [current `cel-api-readonly-principal-v1` profile](examples/api-policy-revision/README.md) preserves original base denials and also requires `principal_present == true` and a nonempty raw `principal_value` for an otherwise allowed `read`. For that otherwise allowed `read`, a false presence flag or empty raw value returns `EXPLICIT_PRINCIPAL_REQUIRED`; a whitespace-only raw value is nonempty because whitespace is not trimmed. These profiles cannot load arbitrary policies, and comparison results do not authorize live API actions.

**Try service-policy checks from Go:** open the [four-file service-policy quickstart](https://gist.github.com/kimjooyoon/af3d75e04ac625e0e08652b8b6a07726). For this frozen Go 1.27.2 example, follow its README to run Go generated from Gooo without a runtime Gooo compiler. Distinguish invalid input from denial, compare the same request before and after a rule change, and inspect a returned widening witness. These calls compare supplied policy facts; they do not apply a grant or call a service.

**Try a Gooo path diagnostic:** [compare two path spellings](examples/path-alias-facts/README.md#run-and-inspect-three-pairs), keep both originals, and see whether slash cleaning makes them equal. Run the supplied inputs, inspect three results and save a replay; these lexical facts do not grant access or establish router/filesystem identity.

**Try automatic header diagnostics:** [inspect a header name and value](examples/header-field-facts/README.md#run-one-external-json-request), strictly decode external JSON, then retain both strings and the first invalid byte in a twelve-field Gooo report. No per-request human approval is needed to calculate the facts.

**Compose an automatic header-addition decision:** the [diagnostic-header addition](examples/diagnostic-header-addition/README.md) combines header facts, payload admission and twelve supplied request observations. Inspect sixteen fields, preserve the candidate and byte witnesses, then use a [fresh Gooo-generated local host](examples/header-addition-host/README.md) for an atomic revision check and application.

**Explain an ETag before using it:** [strong-validator facts](examples/strong-validator-facts/README.md) retain the original header, parsed tag, remaining input, validity, strength, byte lengths and a reason in th