vista-cloud-dev · rafael5 · Jun 16, 2026 · Jun 15, 2026 · Jun 15, 2026 · Jun 15, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -22,5 +22,5 @@ jobs:
   ci:
     uses: vista-cloud-dev/.github/.github/workflows/m-ci.yml@main
     with:
-      engine-free-targets: "check-seams check-icr check-citations check-namespaces check-msl-pin"
+      engine-free-targets: "check-seams check-icr check-citations check-namespaces check-msl-pin check-engine-access"
       engine-targets: ""
diff --git a/Makefile b/Makefile
@@ -18,7 +18,7 @@ ENGINE_FLAGS := $(if $(ENGINE),--engine $(ENGINE)) $(if $(DOCKER),--docker $(DOC
 
 .PHONY: all check fmt fmt-check lint arch test coverage clean \
         seams check-seams icr check-icr check-citations namespaces check-namespaces \
-        pin check-msl-pin gates
+        pin check-msl-pin check-engine-access gates
 
 all: check
 
@@ -89,9 +89,17 @@ pin:
 check-msl-pin:
 	@python3 tools/msl_seam_pin.py --check
 
+# Transport-monopoly gate: no committed test/script/Makefile may hand-roll engine
+# access (raw docker-exec into an engine, iris-session, gtm-dist, etc.). All
+# engine work goes through the m-driver-sdk -> m-ydb/m-iris stack (`m test
+# --docker`, `m vista exec`). The committed-artifact backstop to the PreToolUse
+# engine-stack-guard hook. Org CLAUDE.md §"m/v waterline" -> "Engine access".
+check-engine-access:
+	@python3 tools/check_engine_access.py --check
+
 # Aggregate of the engine-free drift gates (the four own-tier gates + the
-# upward MSL pin).
-gates: check-seams check-icr check-citations check-namespaces check-msl-pin
+# upward MSL pin + the transport-monopoly gate).
+gates: check-seams check-icr check-citations check-namespaces check-msl-pin check-engine-access
 
 # Engine-free gates (fmt/lint/arch + drift gates) + the engine-bound suite. CI
 # runs the full set; `make check-fast` needs no engine.

diff --git a/dist/icr-registry.json b/dist/icr-registry.json
@@ -1 +1,24 @@
-{}
+{
+  "VSLCFG": [
+    {
+      "call": "$$GET^XPAR",
+      "custodian": "XU",
+      "icr": 2263,
+      "source": {
+        "anchor": "getxpar-return-an-instance-of-a-parameter",
+        "doc_key": "XU/krn_8_0_dg_toolkit_ug"
+      },
+      "status": "Supported"
+    },
+    {
+      "call": "EN^XPAR",
+      "custodian": "XU",
+      "icr": 2263,
+      "source": {
+        "anchor": "enxpar-add-change-delete-parameters",
+        "doc_key": "XU/krn_8_0_dg_toolkit_ug"
+      },
+      "status": "Supported"
+    }
+  ]
+}
diff --git a/dist/msl-seam-pin.json b/dist/msl-seam-pin.json
@@ -1,4 +1,35 @@
 {
-  "msl_ref": "v0.6.0",
-  "seams": {}
+  "msl_ref": "v0.7.0",
+  "seams": {
+    "STDENV": {
+      "contract_version": 1,
+      "entry_points": [
+        {
+          "args": [
+            {
+              "doc": "by-ref env tree",
+              "name": "env",
+              "type": "array"
+            },
+            {
+              "doc": "env key",
+              "name": "key",
+              "type": "string"
+            },
+            {
+              "doc": "fallback when key is absent",
+              "name": "default",
+              "type": "string"
+            }
+          ],
+          "label": "$$get^STDENV(env, key, default)",
+          "raises": [],
+          "returns": {
+            "doc": "env(key) or default",
+            "type": "string"
+          }
+        }
+      ]
+    }
+  }
 }
diff --git a/dist/namespace-registry.json b/dist/namespace-registry.json
@@ -9,6 +9,8 @@
   },
   "discovered": {
     "globals": [],
-    "routines": []
+    "routines": [
+      "VSLCFG"
+    ]
   }
 }
diff --git a/docs/memory/MEMORY.md b/docs/memory/MEMORY.md
@@ -2,6 +2,7 @@
 
 One line per memory file. Content lives in the files, not here.
 
+- [t1.2-vslcfg](t1.2-vslcfg.md) — VSL T1.2 (2026-06-16): **VSLCFG**, the first VSL* module — binds the STDENV config seam to XPAR at the **SYS entity** (`$$get`=`$$GET^XPAR("SYS",…)`, `$$set`=`EN^XPAR("SYS",…)`), validated live on vehu. **All 3 determinism boundaries GREEN** (① re-pin `msl_ref`→v0.7.0 carrying real STDENV; ② check-icr ICR #2263; ③ check-citations vs gold corpus). Citation reconciled: **XU/krn_8_0_dg_toolkit_ug / ICR #2263**, not the plan's XT guess. **Keystone unblock:** driver→live XPAR via `M_YDB_GBLDIR`/`M_YDB_ROUTINES`. **Remaining blocker:** `m test --docker` honors gbldir but NOT M_YDB_ROUTINES → VSLCFGTST aborts 0/0 (XPAR routines unresolved); fix = layer the resident routine base in the m test/m-ydb path (m-cli/m-ydb session) or test-in-place `--resident`.
 - [meta-root + owed VSLSEED filer](meta-root-and-owed.md) — layer declared in **root `repo.meta.json`** (migrated off `dist/` 2026-06-15, Phase B item 1); the owed `fileViaDie^VSLSEED` FileMan filer (re-homed from m-stdlib STDSEED per the G2 waterline decision) lands here when a v-layer seeding consumer needs it.
 - [t0b4-msl-seam-pin](t0b4-msl-seam-pin.md) — VSL T0b.4 (v-stdlib leg, 2026-06-15): the **cross-repo MSL seam-contract pin** — `dist/msl-seam-pin.json` (pins MSL `v0.6.0` + frozen `seams` copy) + `tools/msl_seam_pin.py` drift gate (`make check-msl-pin`). Reads the sibling MSL @ tag via `git show`; **SKIP-green when unreachable** (so it SKIPs in CI today, asserts at dev-time); fetch-at-tag path deferred to T1.1. Don't conflate with v-stdlib's own (VSL*) `dist/seam-snapshot.json`.
 - [t0b3-drift-gates](t0b3-drift-gates.md) — VSL T0b.3 (v-stdlib leg, 2026-06-15): the **four drift gates** mirrored from m-stdlib (tools/ copied verbatim except gen-manifest's `VSL*` glob). All **green-empty** (no VSL* modules yet); red-on-violation proven. `repo.meta.json` gained `namespaces: {VSL}`; `ci.yml` runs them via an `m-ci.yml` caller with `engine-targets: ""` (engine-free). fmt/lint left out of CI (Makefile `M` default is a local path). Next: T0b.4 freeze+pin the seam contract.
diff --git a/docs/memory/t1.2-vslcfg.md b/docs/memory/t1.2-vslcfg.md
@@ -0,0 +1,65 @@
+---
+name: t1.2-vslcfg
+description: VSL T1.2 DONE — VSLCFG adapter (binds STDENV config seam to XPAR); all 3 boundaries green + VSLCFGTST 3/3 GREEN on both engines (the m test routine-base blocker was fixed in m-cli)
+metadata:
+  type: project
+---
+
+# VSL T1.2 — VSLCFG adapter over XPAR (v-stdlib, 2026-06-16)
+
+First `VSL*` module. Binds the MSL config-read seam (`$$get^STDENV`) to VistA
+XPAR (Parameter Tools) at the **SYS entity**. Branch `t1.2-vslcfg`.
+
+**The adapter:** `$$get^VSLCFG(key,default)` = `$$GET^XPAR("SYS",key,1)` (empty →
+default); `$$set^VSLCFG(key,value)` = `EN^XPAR("SYS",key,1,value)`. SYS-entity read
+is the faithful analog of STDENV's flat key→value config (NOT a precedence walk —
+`$$GET^XPAR("ALL",…)` did **not** return a SYS value for the probed param, so bind
+SYS directly). Contains ONLY the VistA binding; no parsing/formatting (waterline).
+Round-trip + restore proven live on vehu via `m vista exec`.
+
+**Citation reconciled (the plan was WRONG):** XPAR is documented under **Kernel**
+`XU/krn_8_0_dg_toolkit_ug` (is_latest, verified), governed by **ICR #2263
+(Supported, custodian XU)** — NOT the plan's `XT/ktk7_3p26sp` / `XT*7.3*26`.
+Anchors: `$$GET^XPAR`→`#getxpar-return-an-instance-of-a-parameter`,
+`EN^XPAR`→`#enxpar-add-change-delete-parameters`.
+
+**All three determinism-ledger boundaries GREEN (engine-free):**
+- ① `check-msl-pin`: re-pinned `dist/msl-seam-pin.json` `msl_ref` v0.6.0→**v0.7.0**
+  (`make pin`); pin carries real `seams.STDENV`, matches MSL@v0.7.0.
+- ② `check-icr`: 2 declarations (ICR #2263) for the `$$GET^XPAR`/`EN^XPAR` sites.
+- ③ `check-citations`: both `@source` anchors verified vs the vdocs gold corpus.
+Plus check-seams/namespaces/engine-access + fmt/lint/arch — `make check-fast` clean.
+
+**THE BIG UNBLOCK — driver → live XPAR (keystone):** the m-ydb docker transport
+reaches vehu but with an EMPTY `$ZGBLDIR` by default → VistA data globals invisible
+(VSLSMOKETST passed only on staged routines + scratch). Fix = the same gbldir/
+routines env `v pkg` used (see m-ydb memory `m-ydb-docker-gbldir`):
+`M_YDB_CONTAINER=vehu M_YDB_GBLDIR=/home/vehu/g/vehu.gld M_YDB_ROUTINES='<vehu
+gtmroutines>'`. Then `m vista exec --engine ydb --transport docker '<M>'` sees
+globals (1211 XPAR defs) AND resolves `$$GET^XPAR`.
+
+**THE BLOCKER — FIXED in m-cli (2026-06-16).** `m test --docker` uses m-cli's
+internal **DockerEngine** (not the m-ydb driver), which exported
+`ydb_routines="<stageDir> $ydb_routines"`. A GT.M VistA (`vehu`) sets
+`gtmroutines`, NOT `ydb_routines`, so the export became stageDir-only and (since
+GT.M honors `ydb_routines` over `gtmroutines`) vehu's resident XPAR/FileMan
+routines vanished → VSLCFGTST aborted **0/0**. Fix = `dockerEnvPrefix` falls back
+to `${ydb_routines:-$gtmroutines}` (m-cli `docker-routines-base` `d9ee76a`; see
+m-cli memory `docker-routines-gtmroutines-fallback`). **VSLCFGTST now 3/3 GREEN on
+vehu (YDB) + foia-t12 (IRIS `--namespace VISTA`)** — no `M_YDB_*` host vars needed;
+m-test-engine regression green. The driver *exec* path (m vista exec / v pkg) was
+never affected — that uses the m-ydb driver + `M_YDB_*` knobs (a separate path).
+
+**Test fixture note:** a hand-built `#8989.51` def (direct global SETs) is NOT
+enough for `EN^XPAR` to FILE a value (no error, nothing stored) — XPAR's filer
+needs a FileMan-built def. So VSLCFGTST's `setup` finds an existing free-text
+param that's unset at SYS and round-trips (probe-set/read/restore; touches only
+empty params, restores immediately). `BPS USRSCR` is one such on vehu.
+
+**Engine recipe also:** `--routines` is repeatable (stage v-stdlib `src` +
+m-stdlib `src`). IRIS leg: `--engine iris --docker foia-t12 --namespace VISTA`
+(XPAR lives in the VISTA namespace; the m-iris gbldir/routines equivalent is TBD).
+All engine work goes through the driver stack — never raw `docker exec` (see shared
+memory `engine-access-through-driver-stack`).
+
+Full detail: `docs/plans/t1.2-vslcfg-design.md`.