coderdan · Oct 8, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026
@@ -1122,9 +1122,10 @@ uses the guest.
    kinds, not new names. A wire-format addition, so it goes in the first
    engine PR. This is the one gap in the plan approach itself that the
    language check found. #1069 added the type to the grammar as an optional
-   key, so a field with none is still dispatched on each value's own tag;
-   that is transitional, until Go fills the type (#1046) and the key becomes
-   required on indexed fields.
+   key; the Go SDK fills it on every field from the Go type (#1094), and
+   since #1082 the key is required on every field with a term output: a plan
+   whose indexed field has none is refused when it is built. A field that
+   only seals, or only carries its value through, may still leave it out.
 2. **The guest's synchronous transport import, on the edge path only.**
    `transport_send` is synchronous from the guest's point of view and the ABI
    relies on it ("`block_on` never parks"). A wazero host function may block a

@@ -46,6 +46,12 @@ func (k *Checker) Check(ctx context.Context, plan *record.Plan) error {
 	if err := plan.Validate(); err != nil {
 		return fmt.Errorf("%w: %v", ErrEncoding, err)
 	}
+	return k.engineCheck(ctx, plan)
+}
+
+// engineCheck asks se_plan_check alone, with no host rule first: the half
+// of Check that reaches the engine.
+func (k *Checker) engineCheck(ctx context.Context, plan *record.Plan) error {
 	encoded, err := vcffi.Marshal(plan.Wire())
 	if err != nil {
 		return fmt.Errorf("%w: %v", ErrEncoding, err)

@@ -15,7 +15,8 @@ import (
 // which a Rust record opens when its field is a Value. Every sealed field has a
 // scalar kind: stashgen refuses a struct, slice or map outside an opaque
 // struct, and an opaque struct seals as Bytes (one JSON document). Untyped
-// names a field with no declared type and is not what generated code writes.
+// names a field with no declared type; generated code never writes it, and
+// the engine refuses a plan whose indexed field has no type.
 type Kind string
 
 // The kinds. int8, int16 and int32 are Int32; int and int64 are Int64;

@@ -99,8 +99,8 @@ pub fn status_for_error(error: &stack_encrypt::Error) -> u32 {
 /// A dynamic-path error as a status code.
 ///
 /// The split the library draws is the one the ABI needs: `Context`, `Term`,
-/// `Plan`, `Source` and `Record` are each a statement about the caller's
-/// input, decided before any key is minted or retrieved, so they are
+/// `Plan`, `UntypedIndex`, `Source` and `Record` are each a statement about
+/// the caller's input, decided before any key is minted or retrieved, so they are
 /// [`STATUS_ENCODING`] — named one by one, because that verdict is the
 /// host's to act on and must be given deliberately. `Cipher` defers to
 /// [`status_for_error`]; `Internal` is the library's own invariant failing
@@ -116,9 +116,12 @@ pub fn status_for_error(error: &stack_encrypt::Error) -> u32 {
 pub fn status_for_dynamic(error: &stack_encrypt::dynamic::Error) -> u32 {
     use stack_encrypt::dynamic::Error;
     match error {
-        Error::Context | Error::Term { .. } | Error::Plan | Error::Source | Error::Record => {
-            STATUS_ENCODING
-        }
+        Error::Context
+        | Error::Term { .. }
+        | Error::Plan
+        | Error::UntypedIndex { .. }
+        | Error::Source
+        | Error::Record => STATUS_ENCODING,
         Error::Cipher(e) => status_for_error(e),
         // A target refusal is a statement about the plan, the label or the
         // value (an unknown or unproducible type, an extended plan, a value
@@ -442,6 +445,12 @@ mod tests {
                 },
             ),
             ("a bad plan", Error::Plan),
+            (
+                "an indexed field with no type",
+                Error::UntypedIndex {
+                    field: "age".to_string(),
+                },
+            ),
             ("a bad source", Error::Source),
             ("a bad record", Error::Record),
         ] {

@@ -163,13 +163,15 @@ fn plan_under(ctx: impl Fn(&str) -> FfiValue) -> Vec<u8> {
             obj(vec![
                 ("context", ctx("age")),
                 ("outputs", FfiValue::Array(vec![s("c"), s("eq"), s("ore")])),
+                ("type", s("uint32")),
             ]),
         ),
         (
             "name",
             obj(vec![
                 ("context", ctx("name")),
                 ("outputs", FfiValue::Array(vec![s("c"), s("match")])),
+                ("type", s("string")),
             ]),
         ),
     ]))
@@ -1296,6 +1298,17 @@ fn plan_check_answers_without_a_cipher() {
     )]));
     assert_eq!(ops::plan_check(&bad_index), Err(STATUS_ENCODING));
 
+    // an indexed field with no declared type: every term derives from one
+    // declared kind, so the plan is refused before any value arrives.
+    let untyped_index = encode(obj(vec![(
+        "age",
+        obj(vec![
+            ("context", label("age")),
+            ("outputs", FfiValue::Array(vec![s("c"), s("eq")])),
+        ]),
+    )]));
+    assert_eq!(ops::plan_check(&untyped_index), Err(STATUS_ENCODING));
+
     // a one-segment context is not a label a fields plan can seal under.
     let one_segment = encode(obj(vec![(
         "age",

@@ -732,6 +732,44 @@ func TestGuestRefusesMalformedInputsBeforeState(t *testing.T) {
 	}
 }
 
+// An indexed field with no declared kind is refused by the Checker, naming
+// the field: the engine derives every term from one declared kind, and the
+// generator never emits such a declaration, so only a plan built by hand
+// reaches this. A sealed-only untyped field passes.
+func TestCheckerRefusesAnIndexedUntypedField(t *testing.T) {
+	guestOrSkip(t)
+	ctx := context.Background()
+	checker, err := NewChecker(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer checker.Close()
+	for name, outputs := range map[string][]record.Output{
+		"equality": {record.Ciphertext, record.Equality},
+		"match":    {record.Ciphertext, record.Match},
+		"ore":      {record.Ciphertext, record.Ore},
+		"ope":      {record.Ope},
+	} {
+		p := &record.Plan{Context: []string{"users"}, Fields: []record.Field{{Name: "age", Kind: record.Untyped, Outputs: outputs}}}
+		// Through Check, the Go rule refuses first and names the field.
+		err := checker.Check(ctx, p)
+		if !errors.Is(err, ErrEncoding) || !strings.Contains(err.Error(), `field "age"`) {
+			t.Errorf("%s: err = %v, want ErrEncoding naming the field", name, err)
+		}
+		// Past it, the engine refuses the same plan (Error::UntypedIndex in
+		// stack-encrypt) and the guest reports it as the caller's input. The
+		// ABI carries a status word and no message, so the field's name is
+		// the Go rule's to give; this asserts the two rules agree.
+		if err := checker.engineCheck(ctx, p); !errors.Is(err, ErrEncoding) {
+			t.Errorf("%s past Validate: err = %v, want ErrEncoding from the engine", name, err)
+		}
+	}
+	sealed := &record.Plan{Context: []string{"users"}, Fields: []record.Field{{Name: "notes", Kind: record.Untyped, Outputs: []record.Output{record.Ciphertext}}}}
+	if err := checker.Check(ctx, sealed); err != nil {
+		t.Errorf("a sealed-only untyped field: %v", err)
+	}
+}
+
 // se_plan_check answers with no cipher: a plan the engine runs passes, a
 // plan it refuses is ErrEncoding, never ErrState.
 func TestPlanCheckAnswersWithoutACipher(t *testing.T) {

@@ -197,8 +197,8 @@ func CheckPart(part any) error {
 
 // Validate checks what the host can check before the engine sees the plan:
 // a context, plain segments, at least one field, names and identities once,
-// outputs once and at least one, known kinds, and extension parts the codec
-// carries. The engine's own rules — which index a kind admits, what the
+// outputs once and at least one, known kinds, a kind on every indexed field,
+// and extension parts the codec carries. The engine's own rules — which index a kind admits, what the
 // builder refuses — are the engine's, asked through se_plan_check.
 func (p *Plan) Validate() error {
 	switch {
@@ -279,6 +279,11 @@ func (p *Plan) Validate() error {
 				return fmt.Errorf("record: field %q: output %q is asked for twice", f.Name, o)
 			}
 			seen[o] = true
+			// The engine refuses this too; it is named here, with the field,
+			// so a declaration is corrected where it was written.
+			if o.IsTerm() && f.Kind == Untyped {
+				return fmt.Errorf("record: field %q: an indexed field declares its type, so every value's %s term derives from one kind; declare the field's kind", f.Name, o)
+			}
 		}
 	}
 	return nil

@@ -136,15 +136,32 @@ func TestValidateRefusals(t *testing.T) {
 		"unknown kind":        one(Field{Name: "a", Kind: "integer", Outputs: []Output{Ciphertext}}),
 		"no output":           one(Field{Name: "a"}),
 		"unknown output":      one(Field{Name: "a", Outputs: []Output{"json"}}),
-		"output twice":        one(Field{Name: "a", Outputs: []Output{Equality, Equality}}),
+		"output twice":        one(Field{Name: "a", Kind: Uint32, Outputs: []Output{Equality, Equality}}),
 		"bad extension part":  {Context: []string{"users"}, Extension: []any{1.5}, Fields: []Field{{Name: "a", Outputs: []Output{Ciphertext}}}},
 		"name is not a label": one(Field{Name: "b64:x", Outputs: []Output{Ciphertext}}),
+		"indexed and untyped": one(Field{Name: "a", Outputs: []Output{Ciphertext, Equality}}),
+		"index alone untyped": one(Field{Name: "a", Outputs: []Output{Ope}}),
 	}
 	for name, p := range cases {
 		if err := p.Validate(); err == nil {
 			t.Errorf("%s: accepted", name)
 		}
 	}
+	// A sealed-only field needs no kind; an indexed one is refused with the
+	// field and the term named.
+	if err := one(Field{Name: "notes", Outputs: []Output{Ciphertext}}).Validate(); err != nil {
+		t.Errorf("a sealed-only untyped field: %v", err)
+	}
+	err := one(Field{Name: "age", Outputs: []Output{Ciphertext, Ore}}).Validate()
+	if err == nil || !strings.Contains(err.Error(), `field "age"`) || !strings.Contains(err.Error(), "ore term") {
+		t.Errorf("an indexed untyped field: err = %v, want the field and the term named", err)
+	}
+	// A repeated output is refused for the repetition: the field is typed,
+	// so the untyped rule cannot be what refuses it.
+	err = one(Field{Name: "a", Kind: Uint32, Outputs: []Output{Equality, Equality}}).Validate()
+	if err == nil || !strings.Contains(err.Error(), "asked for twice") {
+		t.Errorf("an output asked for twice: err = %v, want the repeated output named", err)
+	}
 }
 
 func TestParseContext(t *testing.T) {

@@ -32,6 +32,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Breaking
 
+- **A data plan field with a term output must declare its `"type"`.** A
+  plan whose indexed field (`"eq"`, `"match"`, `"ore"`, `"ope"`) has no
+  `"type"` is refused when it is built (`Error::UntypedIndex`, naming the
+  field), by `record::plan`,
+  `record::plan_with`, `Plan::new` / `Plan::new_with` and
+  `Plan::with_context_field` alike: the field's
+  terms derive from the one declared kind, with every value checked against
+  it, never from whatever tag each value arrived with. The type stays
+  optional on a field whose only output is `"c"` or `"passthrough"`, and on
+  a target field, whose kind is the EQL type's own. The Go SDK already
+  fills `"type"` on every field from the Go type, and `record.Plan.Validate`
+  refuses an indexed `Untyped` field naming it, so generated code is
+  unaffected; a plan written by hand without types must add them. Declaring
+  a type changes no stored byte, so a row stored as the declared kind opens
+  as before. A row stored as another kind fails to open with
+  `PlanError::FieldType`, and fails any batch that holds it; its terms do
+  not match a query of the declared kind either. Re-encrypt such rows as
+  the declared kind: they are still readable, because a plan that gives the
+  field only `"c"` and no `"type"` remains valid and opens a row of any
+  kind, whatever indexes it was sealed with. Open the rows under that plan,
+  convert each value to the declared kind, and encrypt it again under the
+  typed plan.
+
 - **A target description carries a source mode.** `Encryption` gains a
   last type parameter, `M: SourceMode = Borrowed`, saying how it is handed
   its plaintext. Code that names `Encryption<'s, S, T, K, Ctx>` still
@@ -75,8 +98,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Every data plan field seals the tagged `FfiValue` leaf, whatever its
   `"type"`**, as every field did before; the type admits indexes and checks
   kinds and changes no bytes, so a row written without a type opens under a
-  plan that declares one, and a binding that starts sending `"type"`
-  re-encrypts nothing. A Rust `u32` or `String` field under the same label
+  plan that declares the kind it was sealed as, and a binding that starts
+  sending `"type"` re-encrypts nothing stored as that kind. A Rust `u32` or `String` field under the same label
   derives the same terms as the data field but a different leaf, and the
   two leaves cannot be told apart by inspection (a bare string that begins
   with U+000A is a valid tagged string), so the lowering does not choose an

@@ -33,7 +33,7 @@ use arbitrary::Arbitrary;
 use libfuzzer_sys::fuzz_target;
 use stack_encrypt::dynamic::record::{check_record, plan_with, Plan};
 use stack_encrypt::dynamic::{
-    FfiValue, TargetDescriptor, TargetError, TargetResolver, ValueKind,
+    FfiValue, Output, TargetDescriptor, TargetError, TargetResolver, ValueKind,
 };
 use stack_encrypt::{KeysetCipher, Label, Pending, SealedValue, StackCipher, StackCipherText};
 use uuid::Uuid;
@@ -166,12 +166,51 @@ enum SpecEntry {
     Context(Ctx),
     Outputs(Vec<Name>),
     Target(Name),
+    /// A `"type"`: required on an indexed field, so a plan with terms parses
+    /// only when one of these names a kind that admits them.
+    Type(Kind),
     ContextWrongShape(u32),
     OutputsWrongShape(u32),
     TargetWrongShape(u32),
     Unknown(Ctx),
 }
 
+/// A `"type"` value: the scalar kinds, an object, and a name that is not
+/// one. `Bool` is the kind that admits `"ore"` / `"ope"` but not `"eq"`, so
+/// a plan can be refused for one index and accepted for another.
+#[derive(Arbitrary, Debug, Clone, Copy)]
+enum Kind {
+    Bool,
+    UInt32,
+    UInt64,
+    Int32,
+    Int64,
+    Float32,
+    String,
+    Bytes,
+    Float64,
+    Object,
+    NotAKind,
+}
+
+impl Kind {
+    fn as_str(self) -> &'static str {
+        match self {
+            Kind::Bool => "bool",
+            Kind::UInt32 => "uint32",
+            Kind::UInt64 => "uint64",
+            Kind::Int32 => "int32",
+            Kind::Int64 => "int64",
+            Kind::Float32 => "float32",
+            Kind::String => "string",
+            Kind::Bytes => "bytes",
+            Kind::Float64 => "float64",
+            Kind::Object => "object",
+            Kind::NotAKind => "integer",
+        }
+    }
+}
+
 impl SpecEntry {
     fn into_entry(self) -> (String, FfiValue) {
         match self {
@@ -185,10 +224,10 @@ impl SpecEntry {
                         .collect(),
                 ),
             ),
-            SpecEntry::Target(name) => (
-                "target".to_string(),
-                FfiValue::String(name.as_str().into()),
-            ),
+            SpecEntry::Target(name) => {
+                ("target".to_string(), FfiValue::String(name.as_str().into()))
+            }
+            SpecEntry::Type(kind) => ("type".to_string(), FfiValue::String(kind.as_str().into())),
             SpecEntry::ContextWrongShape(v) => ("context".to_string(), FfiValue::UInt32(v)),
             SpecEntry::OutputsWrongShape(v) => ("outputs".to_string(), FfiValue::UInt32(v)),
             SpecEntry::TargetWrongShape(v) => ("target".to_string(), FfiValue::UInt32(v)),
@@ -364,6 +403,23 @@ fuzz_target!(|case: Case| {
         }
         return;
     };
+    // One rule of the parsed plan is asserted here rather than left to the
+    // model: every field with a term output declares its type. The parser
+    // ends in `Plan::new_with`, which enforces it, so a plan that reaches
+    // this point with an untyped indexed field means a parse path was added
+    // that does not. A target field's kind is the type's own and it has no
+    // outputs of its own, so the rule reads as written over `outputs()`.
+    for field in plan.fields() {
+        let indexed = field
+            .outputs()
+            .iter()
+            .any(|output| matches!(output, Output::Term(_)));
+        assert!(
+            !indexed || field.target().is_some() || field.field_type().is_some(),
+            "a parsed plan has an indexed field with no type: {:?}",
+            field.name()
+        );
+    }
     let expected = model_accepts(&record, &plan);
     let actual = check_record(record.into_ciphertext(), &plan, None).is_ok();
     if trace {

@@ -33,8 +33,10 @@
 //!   types of its own can rely on the declaration for what it gets back (an
 //!   integer, not a float; bytes, not a string).
 //!
-//! A field with no `"type"` is dispatched on each value's own tag. That is
-//! transitional; see [`record::plan`](super::record::plan()).
+//! Every field with a term output declares its kind; a plan whose indexed
+//! field has none is refused when it is built
+//! ([`Error::UntypedIndex`], naming the field). A field that only seals, or
+//! only carries its value through, may leave it out: no term derives from it.
 use vitaminc_aead_value::{FfiValue, ValueKind};
 
 use super::Error;

@@ -59,9 +59,9 @@
 //! vitaminc's [`ValueKind`], re-exported here, whose names vitaminc freezes
 //! beside its tag table. This crate adds only what a kind means to an index
 //! ([`admits`]) and to a query value ([`read`]); it decides nothing about
-//! the bytes ([`record`]). A field without `"type"` is dispatched on each
-//! value's own tag; that is transitional, and [`record::plan`] says until
-//! when.
+//! the bytes ([`record`]). Every field with a term output declares one;
+//! a plan whose indexed field has none is refused when it is built
+//! ([`Error::UntypedIndex`], naming the field).
 //!
 //! For the same reason the enums that spell them — [`Output`],
 //! [`IndexSpec`] and [`ValueKind`] — are *not* `#[non_exhaustive]`, against this workspace's
@@ -185,6 +185,19 @@ pub enum Error {
     #[error("record plan is malformed")]
     Plan,
 
+    /// A record plan field has a term output (`"eq"`, `"match"`, `"ore"`,
+    /// `"ope"`) and declares no `"type"`. The field's terms derive from the
+    /// one declared kind, never from whatever tag each value arrived with,
+    /// so the plan is refused when it is built, before any value arrives.
+    /// Its own variant rather than a cause of [`Plan`](Error::Plan) because
+    /// it names the field: it is the refusal a plan written before types
+    /// were required meets first, and the one a caller fixes field by field.
+    #[error("record plan field {field:?} has a term output and no declared type")]
+    UntypedIndex {
+        /// The field's name — its key in the plan.
+        field: String,
+    },
+
     /// A record source does not fit its plan: not an object (or an array of
     /// them), a field the plan does not name, a plan field the source does
     /// not carry or carries twice, or a passthrough or a repeated map key