Language policy

All code is authored in KEC Lisp. A C file is justified only when it is the FFI layer itself. This is a standing project rule, stated by the product owner on multiple occasions and codified here on 2026-08-02. It binds every contributor and every agent brief.

The rule

C exists in this tree to give Lisp its primitives. Everything above the primitive layer is KEC Lisp: gameplay, screens, programs, carts, mission and economy logic, generation, scheduling policy, and test cases.

A new .c file, or new logic inside an existing one, is acceptable only when the deliverable is the FFI layer:

• binding seams (*_bind functions, bridge primitives in nosh_lisp_bridge.c);
• glue that crosses the boundary into Lisp (event-bus or scheduler callbacks whose body is an invocation of a Lisp entry point);
• device drivers and realtime kernels that primitives expose (the framebuffer blitter, the PSG synthesis inside the audio callback, SPI/UART/OLED transport);
• the interpreter embedding and arena plumbing;
• thin test runners (lifecycle only; cases live in .lsp suites, per the testing rule in documentation-standard.md and the repository conventions).

Logic never goes in C again. When a change touches an existing C core that holds logic, the change migrates that logic to Lisp behind a thin seam rather than extending the C.

Standing debt

C files carrying logic that predates this codification, tracked for migration under GWP-777:

File	Logic to migrate
runtime/src/mission_board.c	Template pool, contract generation and filtering, minting
runtime/src/board_screen.c	Tier and broke-bonus math, countdown, verb policy

Migrated already on the ICE Breaker sprint stack (PRs #202 to #204): the mission-end pricing (runtime/system-image/lib/mission/pricing.lsp), the contract reader API (mission/contract.lsp over one raw primitive), and the sweep arming policy (sweep/sweep.lsp); the corresponding C files hold mechanisms only.

The seams themselves (board_screen_bind, the accept sink, the event publishes) stay in C: they are the FFI layer.

Enforcement

• Every engineering brief carries this rule.
• Review rejects a PR that adds C logic outside the FFI layer.
• The capability boundary argument (“the engine owns mission truth”) governs which CONTEXT may mutate state; it does not license writing the algorithm in C. The binding set enforces ownership; the implementation language is free to be Lisp.