feat(wit): author the nexum:intent package with pool interface

[mfw78]

What

Authors the nexum:intent@0.1.0 WIT package in wit/nexum-intent/ (types.wit and pool.wit), stacked on the nexum:value-flow package from #226.

types.wit defines the venue-neutral intent ontology: intent-header (gives/wants/valid-until/settlement/authorisation, built over nexum:value-flow's asset-amount and settlement), the auth-scheme variant (eip712 / eip1271 / presign / offchain-sig / unsigned), the intent-status variant (pending / open / settled(option<list<u8>>) / failed(fail-reason) / expired / cancelled) with a structured fail-reason record, a receipt alias, unsigned-tx (chain-id, to, value, input, a call description only, the host fills in gas and signs), the submit-outcome variant (accepted(receipt) / requires-signing(unsigned-tx)), and a self-contained venue-error variant (8 cases) that does not depend on nexum:host.

pool.wit defines the strategy-module-facing pool interface: submit / status / cancel keyed by a venue string, body/receipt as opaque bytes, submit returning result<submit-outcome, venue-error>.

crates/nexum-runtime/src/bindings.rs gains an intent_smoke test module: a throwaway nexum:intent-smoke world importing nexum:intent/pool, a DummyPool host impl pinning the three function signatures, and a test that names every generated type, case, and field by its plain Rust spelling.

Why

The pool interface is the venue-neutral contract that strategy modules and venue adapters build against. Defining the intent ontology on top of the value-flow vocabulary keeps a submission described the same way to strategy modules, venue adapters, and guard policy, and keeping venue-error self-contained avoids pinning this package's freeze cadence to nexum:host versioning.

Testing

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace

AI Assistance

Claude (Opus) used for the implementation.

Closes #227

[lgahdl]

Clean design for the intent ontology. Four items below.

[lgahdl]

Unit mismatch with the block clock modules actually receive. Tick.epoch_s — the block-time value available to every strategy via on_block / on_tick — is in seconds (explicitly named _s; supervisor tests use 1_700_000_000). valid-until is in milliseconds, so a module comparing expiry against the current block time must divide by 1000 with no hint from either type. Either rename this field valid-until-ms to make the unit visible at the use site, or switch to seconds to match the block clock convention.

Suggested change

	/// Expiry in milliseconds since the Unix epoch, UTC; absent means
	/// the venue's own default lifetime applies.
	valid-until: option<u64>,
	/// Expiry in seconds since the Unix epoch, UTC; absent means
	/// the venue's own default lifetime applies.
	valid-until: option<u64>,

[lgahdl]

The option wrapper is unexplained. Readers need to know when absence is expected (not just what Some means).

Suggested change

	/// Settled. The payload is venue-defined settlement proof (for an
	/// EVM venue, typically the settlement transaction hash).
	settled(option<list<u8>>),
	/// Settled. `some` carries venue-defined settlement proof (for an
	/// EVM venue, typically the tx hash); `none` when the venue confirms
	/// settlement but issues no on-chain proof (e.g. a fully off-chain venue).
	settled(option<list<u8>>),

[lgahdl]

denied is a host policy decision, not a venue response — it arrives over the same error channel as adapter errors (invalid-body) and venue refusals (rejected), making it easy to accidentally retry. The caller MUST NOT retry on denied; the other error variants may warrant retry.

Suggested change

	/// Guard policy refused the egress before it reached the venue.
	denied(string),
	/// Guard policy refused the egress before it reached the venue;
	/// this is a host decision, not a venue response. Callers must not retry.
	denied(string),

[lgahdl]

none is not a Python keyword — Python's keyword is None (capitalised). The real risk is in Rust: wit-bindgen title-cases variant names, so a case named none would generate a Rust identifier None that shadows Option::None in the enum's namespace. The rationale is correct but the language cited is wrong.

Suggested change

	/// keyword anywhere (`unsigned` not `none`, a Python keyword;
	/// keyword anywhere (`unsigned` not `none` (Rust: bindgen title-cases variants,
	/// making `none` → `None` which shadows `Option::None`);