Conclusão estimada: 35%

Grove Conversion Roadmap

This roadmap orders conversion of the mixed-generation grove/libs corpus to the operational clean LLVM language. Compiler/backend work remains in seed/compiler/llvm/ROADMAP.md; detailed machine-learning product work remains in the repository-root roadmap-ml.md.

The conversion unit is a package, not an individual source file. Directory presence or success under a superseded compiler is inventory evidence only.

Inventory baseline — 2026-07-12

Every Grove package now has a manifest.

No Grove source contains direct FFI. Packages that formerly depended on an unaudited foreign owner are explicitly archived at their gate boundary.

Dependency analysis

The gate order uses explicit use edges found under each package's src/ tree. Highest explicit fan-in packages are:

This graph is a lower bound. Legacy source often calls implicit runtime helpers without use, and malformed benchmark files contain concatenated imports. Every gate must therefore refresh dependencies after parsing/porting its packages. Discovery of a hidden dependency may move a package to a later gate; it must never create a silent dependency on an unconverted package.

The plan covers every current Grove library exactly once. G01–G21 contain ten packages each; G22 contains eight. No currently explicit dependency points to a later gate. Dependencies inside one gate define that gate's internal order.

Status vocabulary

Do not use “implemented” or a check mark merely because legacy source exists.

Universal package promotion contract

Every package in every gate must satisfy all applicable requirements:

1. Disposition: choose merge, port, rename, archive, or remove. A Grove package that overlaps an operational package such as math, io, slice, sort, time, or vec must not create a second canonical package with the same role.
2. Syntax: lower-snake names, current declarations, ret, //, current ADTs/options/results, and no legacy channel/detached-spawn syntax.
3. Typing: operational parser, resolver, generic/trait checks, and target layout checks pass.
4. Ownership: moves, clones, views, partial initialization, destructors, and structured exits have exact cleanup.
5. Effects: allocation, panic, blocking, I/O, FFI, syscalls, and unsafe behavior are explicit and valid for the runtime profile.
6. Errors: recoverable failure uses typed options/results, not unchecked sentinels or hidden process termination.
7. Interfaces: current .sdi emission and source-elided consumption pass, including generics, destructor, clone, effects, and provenance as applicable.
8. Manifest: identity, version, kind, target/profile metadata, dependencies, and publish --check pass.
9. FFI: platforms and root INSTALL.md are present; raw declarations stay behind audited nominal owners/views.
10. Validation: positive, negative, sanitizer, malformed-input, and cross-target tests exist in proportion to risk.
11. Documentation: examples compile with build/run; no legacy runtime helper is documented as a clean compiler built-in.
12. Closure evidence: record commands, packages, dispositions, exclusions, targets, and test results in seed/compiler/llvm/tests/GROVE_GXX_BASELINE.md.

Wave 1 — language and runtime foundations

G01 — scalar algorithms and conversion harness

Packages: math, format, dtoa, fibonacci, primes, crc32, semver, protocol, test_framework, bench.

Depends on: operational language/core only.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G01_BASELINE.md.

Specific closure: resolve overlap with operational math, format, and fibonacci; add missing manifests for crc32 and protocol; establish the reusable Grove conversion test/benchmark harness without legacy globals or hidden output/time built-ins.

G02 — memory, text, slices, and binary substrate

Packages: slice, mem, bytes, raw_vec, str, str_view, stringbuilder, binary, sort, set.

Depends on: G01.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G02_BASELINE.md.

Specific closure: map legacy raw fat slices and byte handles onto native []t/mut []t, bytes, shared_bytes, byte_buffer, vec, and current checked raw memory. Prove initialized extent, provenance, exact release, and source-elided generic behavior. Audit bytes and str_view FFI.

G03 — collections and reusable data algorithms

Packages: hash, hashmap, hashtable, bloom, ringbuf, lru, heap, base64, binary_tree_i64, text_buffer.

Depends on: G01–G02.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G03_BASELINE.md.

Specific closure: add manifests for hashtable and binary_tree_i64; replace copyable raw handles with nominal owners; verify move-only keys/values, resize failure, collision behavior, bounds, malformed binary input, and cleanup after partial construction.

G04 — process, filesystem, and virtual-memory base

Packages: errno, time, env, os, process, path, fs, dir, stat, mmap.

Depends on: G01–G03.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G04_BASELINE.md.

Specific closure: reconcile time/process with operational packages; expose borrowed process/environment views safely; make descriptors, mappings, paths, partial I/O, platform availability, and OS errors explicit.

G05 — structured concurrency and synchronization

Packages: io, atomic, mutex, cond, rwlock, semaphore, barrier, waitgroup, chan, pool.

Depends on: G01–G04.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G05_BASELINE.md.

Specific closure: use the operational task and io packages instead of legacy built-ins; encode channel/ticket/lock endpoints as exact-once owners; verify cancellation, blocked waiter wakeup, drop signaling, memory ordering, region interaction, and sanitizer stress. Audit atomic FFI.

G06 — event loops, networking primitives, and platform I/O

Packages: thread, threadpool, signal, inotify, epoll, net, epoll_loop, eventloop, io_uring, entropy.

Depends on: G01–G05.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G06_BASELINE.md.

Specific closure: reconcile net with the operational socket owner; make registration/cancellation and descriptor lifetime explicit; isolate Linux-only services in manifests; separate structured tasks from legacy detached threads; verify entropy as CSPRNG rather than the non-secret runtime PRNG.

Wave 2 — terminal, CLI, parsers, and security

G07 — terminal primitives and presentation helpers

Packages: tui, tty, terminal, pty, vtbuf, ansi, richtext, progress, prompt, widgets.

Depends on: G01–G06.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G07_BASELINE.md.

Specific closure: define owned terminal modes/descriptors, guaranteed restore on structured exits, UTF-8/byte boundaries, non-interactive behavior, and PTY testability. Resolve the tui/tty same-gate dependency before terminal and prompt.

G08 — TUI composition and CLI authoring

Packages: tui_input, tui_surface, tui_layout, tui_core, tui_widgets, tui_test, clap, command, completion, cli.

Depends on: G01–G07.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G08_BASELINE.md.

Specific closure: port in internal dependency order; replace capitalized UI types; prove surface bounds, resize/input handling, process ownership, command errors, completion determinism, and PTY integration.

macOS AArch64 follow-up closure (2026-07-26): the TUI packages now provide the full interactive resource path that the original portable G08 baseline kept unavailable. tui_core owns safe raw/alternate-screen sessions and typed event waits; tui_input handles incremental keyboard, mouse, paste, resize, and timer events; tui_surface provides Unicode grapheme cells, dirty ANSI diffs, ANSI stripping, and terminal-driven 8/256/truecolor/no-color policy; tui_layout and tui_widgets provide reusable focus, layout, and stateful controls; and tui_test joins synthetic event runs with vtbuf snapshots. seed-tui-demo supplies the deterministic update/render unit gate and a real controlling-PTY acceptance test covering resize, input, Unicode, terminal restoration, fatal signals, and backpressure. Linux revalidation and Windows terminal support remain separate portability phases.

G09 — configuration and text data formats

Packages: cli_completion, dotenv, ini, toml, yaml, json, json_parser, csv, xml, markdown.

Depends on: G01–G08.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G09_BASELINE.md.

Specific closure: return typed parse errors with byte offsets; use borrowed views and byte buffers; cover invalid UTF-8, malformed/truncated documents, depth/size limits, escaping, duplicate fields, streaming input, and round trips.

G10 — application config and binary interchange

Packages: cli_config, url, mime, regex, protobuf, msgpack, rowcodec, tar, zip, compress.

Depends on: G01–G09.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G10_BASELINE.md.

Specific closure: validate URL/range/overflow semantics, archive path safety, binary lengths, regex worst cases, format round trips, and decompression limits. Audit compress FFI and remove shell-backed behavior from safe APIs.

G11 — cryptography, randomness, and identity

Packages: random, uuid, aes, chacha20, hmac, bcrypt, scram, cookies, session, jwt.

Depends on: G01–G10.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G11_BASELINE.md.

Specific closure: label non-cryptographic PRNG APIs; source UUID/session/CSRF secrets from audited entropy; use constant-time comparison where required; validate vectors and token expiry/encoding; zero sensitive temporary buffers where the ownership contract permits. Audit bcrypt FFI.

Post-closure evolution: std-uuid 0.2 adds RFC 9562 UUIDv7 construction and validation using hosted wall-clock milliseconds and the audited OS entropy boundary. Monotonic UUIDv7 sequencing across clock rollback remains a higher-level persistence policy rather than hidden process-global state.

Wave 3 — networking, HTTP, and web layers

G12 — network protocols and TLS base

Packages: tls, dns, icmp, redis, ssh, smtp, _pooltest, http_headers, http_body, http_cookie_jar.

Depends on: G01–G11.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G12_BASELINE.md.

Specific closure: audit TLS FFI and certificate/hostname policy; type transport errors and timeouts; bound protocol frames and DNS names; convert _pooltest into a named package or archive it; prove pooled connection ownership and cookie expiration/domain/path rules.

G13 — HTTP parsing, serving, and middleware primitives

Packages: http_request, http_response, gzip, multipart, form_body, router, middleware, cors, http_server, http_connection_pool.

Depends on: G01–G12.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G13_BASELINE.md.

Specific closure: pass fragmented/partial request input, conflicting lengths, chunking, header/body limits, multipart truncation, route ambiguity, CORS policy, cancellation, keep-alive, and exact connection/buffer cleanup.

G14 — HTTP clients, security, caching, and crawling

Packages: http_client, http_client_tls, http_fetch, cache_http, static, websocket, auth, csrf, crawler, lifecycle.

Depends on: G01–G13.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G14_BASELINE.md.

Specific closure: verify redirect/cookie/pool/TLS composition, cache validators and ranges, path traversal prevention, WebSocket framing, auth/session/CSRF policy, crawler bounds/rate limits, and lifecycle rollback after partial failure.

G15 — web authoring components

Packages: observability, template, webapp, web_request, web_response, web_security, web_static, web_template, web_metrics, websocket_server.

Depends on: G01–G14.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G15_BASELINE.md.

Specific closure: expose lower-snake public types, checked request-derived views, escaped templates by default, explicit raw HTML, bounded metrics state, safe static paths, typed WebSocket lifecycle, and source-elided handler APIs.

G16 — integrated web runtime and application support

Packages: web_core, web_db, web_middleware, web_runtime, web, logging, tensor_graph, sep, table, bench2.

Depends on: G01–G15.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G16_BASELINE.md.

Specific closure: prove one vertical web runtime from socket through parsed request to owned response and cleanup; keep DB hooks typed but backend-neutral; validate middleware order, shutdown/drain, logging backpressure, file-search streaming, table rendering, graph ownership, and a manifest for bench2.

Wave 4 — storage, ML foundations, and high-level orchestration

G17 — storage engines and native DB boundaries

Packages: sqlitec, sqlite, pgc, pager, slotted_page, wal, heapfile, btree_page, btree_store, btree.

Depends on: G01–G16.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G17_BASELINE.md.

Specific closure: audit SQLite/libpq FFI owners and allocator domains; add the btree manifest; prove page checksums/layout/versioning, crash-safe WAL order, short writes, corruption rejection, transaction cleanup, and source-elided storage interfaces.

G18 — tensor and dataset foundations

Packages: tensor, tensor_nd, tensor_cpu, tensor_device, metrics, model_io, quantization, datasets, features, text_features.

Depends on: G01–G17.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G18_BASELINE.md.

Specific closure: establish one owned tensor/storage representation; check shape/stride/size overflow, dtype/layout, views, device transfer, serialized metadata, quantization bounds, deterministic dataset splits, and no hidden copies across CPU/device APIs.

G19 — training and feature pipelines

Packages: nn, loss, optim, autograd, mixed_precision, linear_model, anomaly, image_features, audio_features, vision.

Depends on: G01–G18.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G19_BASELINE.md.

Specific closure: verify gradient ownership and accumulation, optimizer state, overflow/loss scaling, deterministic fixtures, finite-difference checks, shape-safe image/audio transforms, and cleanup of partial computation graphs.

G20 — model execution, compatibility, and acceleration

Packages: tokenizer, transformer, graph_runtime, onnx, model_compat, tensor_cuda, tensor_bench, vision_features, llm_config, text_dataset.

Depends on: G01–G19.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G20_BASELINE.md.

Specific closure: bound tokenizer/model inputs, validate graph operators and external tensor data, reject incompatible checkpoints, audit CUDA FFI/device owners and synchronization, compare CPU/GPU results, and establish reproducible performance/memory baselines.

G21 — trained model components

Packages: text_model, text_image_model, text_audio_model, audio_text_model, vision_text_model, llm_decoder, llm_train, llm_infer, llm_eval, llm_checkpoint.

Depends on: G01–G20.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G21_BASELINE.md.

Specific closure: freeze checkpoint/config identity, deterministic tiny-model training and inference, resumable optimizer state, bounded KV cache, tokenizer compatibility, multimodal tensor contracts, evaluation reproducibility, and exact cleanup under failed load/train/infer operations.

G22 — integrated data and AI orchestration

Packages: sqlite_migrate, pg, pg_poolc, pg_pool, ridge, llm_experiment, llm_runner, multimodal_coordinator.

Depends on: G01–G21.

Status: closed 2026-07-12. Evidence: seed/compiler/llvm/tests/GROVE_G22_BASELINE.md.

Specific closure: validate migrations and pooled transaction ownership against live DB fixtures; complete Ridge recovery/corruption tests; run end-to-end LLM experiment/runner/checkpoint flows; verify multimodal routing and unsupported outputs; publish installable source-elided packages with explicit external service/data requirements.

G01–G22 are closed. Live SQLite/PostgreSQL, Ridge execution, and numeric LLM execution remain explicitly archived capabilities rather than simulated closure.

Gate execution protocol

1. Gates close sequentially. Independent packages inside one gate may be ported in parallel after their same-gate dependencies are identified.
2. Start each gate by regenerating its source/import/FFI/manifest inventory and recording disposition for every package.
3. Land foundational operational-package changes before dependent Grove ports; do not retain compatibility aliases that undermine clean ownership.
4. Run package-local tests first, then source-elided, sanitizer, target, package, install/reuse, and relevant performance checks.
5. A package may be archived or removed instead of ported, but that disposition and all reverse dependencies must be explicit in gate evidence.
6. Close a gate only when every listed package is operational/source-elided or deliberately archived/removed, and no active package depends on an unclassified source.
7. After closure, update Operational Library Reference, Grove Compatibility Tree, and any affected domain page.

Completion definition

The Grove conversion is complete only when:

• all 218 baseline packages have a recorded final disposition;
• every retained package builds with current syntax and semantics;
• the operational catalog is generated from verified manifests/interfaces;
• no current application depends on superseded compiler/runtime behavior;
• normal, sanitizer, target, package, source-elided, and installation gates cover the retained ecosystem at declared support levels;
• inventory drift automatically fails validation instead of silently changing gate scope.