ADR-0012: Components: a program says what it is for the host (strategy, risk, portfolio)

Status: accepted (2026-10-20)

Context#

T0 Lang began as a language for strategies. A serious trading system also needs risk policies that stand between every strategy and the market, and portfolio controllers that decide how capital is shared among strategies -- written, tested, versioned and replaced independently of the strategies, without any of them importing or calling another. The host must be the only thing that connects them, through typed, versioned contracts, and no script may be able to weaken a safety rule the host holds.

Decision#

• A program declares a role with one header: component risk "limits" version "1.0.0";. Roles: strategy, risk, portfolio. The header is language 0.2 and belongs to the program, never to a module.
• The role fixes the entry point and its exact signature (authorize, allocate), and the compiler checks it (E-COMP-ENTRY), so a component that compiles is one the host can bind.
• A risk or portfolio component requires only the contract of its role (E-COMP-CAPABILITY). Those contracts (risk, portfolio) have types and no operations: the component is a function of what it is given, so it cannot read the market, touch a file, use the network or place an order. The language has no clock and no randomness: the same inputs give the same answer, which is what makes a decision replayable.
• Configuration is a struct Config of plain values, the first parameter of the entry point, filled by the host from a binding's configuration. No default is invented for a missing field.
• The artifact records the component (Body.component, IR 0.1.4, left out when absent so no earlier program's hash changes).
• No new syntax beyond the header and no new runtime: the entry point is an ordinary function run by the existing runtime, under the existing limits.

Alternatives#

• A new item kind (risk policy x { … }). More syntax, a second way to write a function, a bigger compiler change for no more checking.
• Roles by file name or a manifest outside the program. The program would no longer say what it is; the compiler could not check it, and the artifact could not carry it.
• Letting a risk policy call host operations (read the market, ask for more data). Every operation is a way to be slow, non-deterministic or to change something. The context carries what a policy may need; a metric the host lacks is None or an explicit unsupported capability, not something a script fetches.

Consequences#

• The host (t0-host) loads a component artifact, checks its role, version and contract versions, and runs it in a worker with a time limit; a policy that fails is a refusal. See docs/risk/ for the firewall that enforces the answers.
• Components are replaced by binding a different name and version; the host records the change.
• A future role is a new row in the table and a new contract, not a new mechanism.