#27 - EPIC: hackmoded — always-on StarLang actor service for Hackmode - nsaspy/hackmode

nsaspy commented

2026-09-02 17:24:35 +00:00

Owner

Outcome

Implement ADR #149: Hackmode runs continuously as hackmoded, with one long-lived StarLang runtime hosting the canonical Hackmode actor topology. CLI/LISH/Emacs/Nyxt become clients of that runtime instead of owning actor-system lifetime.

Architecture authority

ADR: #149
Existing Hackmode actor code: source/hackmode-core/actor-system.lisp, provider-actor.lisp
Hackpert architecture: #24 / #27
Provider/capture work: #135-#141
Typed shell/client work: #14 / #17 / #20
StarLang service-grade dogfood epic: lost-rob0t/star-lang#56
StarLang existing runtime gates: lost-rob0t/star-lang#42, #47, #52, #53

Hard invariants

StarLang is the product actor semantic boundary.
Sento/cl-gserver is an adapter/backend, not Hackmode actor authority.
Tek9/canonical Hackmode storage remains durable operation/graph/KB authority.
Actor-local state is live coordination only.
Passive Hackpert cannot dispatch/mutate; active Hackpert uses typed canonical effects only.
Direct and symbolic reasoning use the same capability/provider/effect boundary.
No second scheduler, second operation DB, second graph store or second KB authority.
No ordinary StarIntel product-development work.

Target topology

HackmodeSystemActor
  +-- ControlActor
  +-- OperationSupervisor
  |     `-- OperationActor[operation]
  +-- ProviderSupervisor
  +-- CaptureSupervisor
  +-- HackpertSupervisor
  `-- OutboxActor

Operation-local children/refs are scoped by stable operation/run identity. External process ownership flows through typed provider/process-port boundaries.

Dependency-ordered work graph

Hackmode-owned slices

#151 — hackmoded bootstrap: service lifecycle, local control boundary, deterministic drain
#152 — migrate Hackmode actor authority from direct Sento construction to StarLang runtime
#153 — OperationSupervisor + operation-scoped actor topology over canonical state
migrate provider actor composition while preserving dispatch-capability as canonical capability boundary
migrate capture/IPX actor composition without granting persistence authority
integrate operation-scoped Hackpert actor sessions without changing passive/active authority
migrate outbox actor composition with unchanged durable outbox semantics
wire #14/#17/#20 clients to the daemon protocol instead of client-owned runtime lifetime
systemd/NixOS service packaging after runtime lifecycle is proven
restart/recovery proof with no duplicate logical effects or leaked processes
remove direct Hackmode production Sento actor-system construction once equivalence is green

Upstream StarLang slices

lost-rob0t/star-lang#42 — real actor-system semantic evidence
lost-rob0t/star-lang#57 — final star-supervisor semantics
lost-rob0t/star-lang#58 — final star-process-port external process lifecycle
lost-rob0t/star-lang#59 — journal/replay/generation fencing/leases after base runtime is final

Dependency policy

When Hackmode needs a missing actor primitive, improve StarLang rather than adding a Hackmode-only supervisor/journal/process runtime. The Hackmode slice waits on or consumes the smallest final-owned StarLang primitive required.

Do not block unrelated provider/Hackpert work that can continue behind current typed boundaries while the runtime migration proceeds.

RED-first acceptance program

Start hackmoded; connect two independent clients to the same runtime.
Open/select an operation without either client creating its own actor system.
Dispatch a typed provider job; provider failure is isolated.
Start/stop an operation-scoped capture service; external process is reaped.
Run passive Hackpert and prove zero dispatch/mutation authority.
Run an admitted active Hackpert action and prove it crosses the existing capability/effect boundary.
Crash/restart one actor child and prove supervisor semantics without restarting the entire daemon.
Restart hackmoded; reconstruct live coordination from canonical state without duplicate logical evidence/actions.
Shut down gracefully; new jobs are rejected during drain and all actor/process/thread resources terminate.
Repository search proves no remaining product path constructs a parallel Hackmode actor system directly.

Definition of done

hackmoded is the normal Hackmode runtime owner, StarLang hosts the actor topology, clients reconnect to it, current provider/Hackpert/capture/storage authority invariants remain intact, restart/shutdown are deterministic, and direct Sento construction is no longer a Hackmode product API.

## Outcome Implement ADR #149: Hackmode runs continuously as `hackmoded`, with one long-lived StarLang runtime hosting the canonical Hackmode actor topology. CLI/LISH/Emacs/Nyxt become clients of that runtime instead of owning actor-system lifetime. ## Architecture authority - ADR: #149 - Existing Hackmode actor code: `source/hackmode-core/actor-system.lisp`, `provider-actor.lisp` - Hackpert architecture: #24 / #27 - Provider/capture work: #135-#141 - Typed shell/client work: #14 / #17 / #20 - StarLang service-grade dogfood epic: `lost-rob0t/star-lang#56` - StarLang existing runtime gates: `lost-rob0t/star-lang#42`, `#47`, `#52`, `#53` ## Hard invariants - StarLang is the product actor semantic boundary. - Sento/cl-gserver is an adapter/backend, not Hackmode actor authority. - Tek9/canonical Hackmode storage remains durable operation/graph/KB authority. - Actor-local state is live coordination only. - Passive Hackpert cannot dispatch/mutate; active Hackpert uses typed canonical effects only. - Direct and symbolic reasoning use the same capability/provider/effect boundary. - No second scheduler, second operation DB, second graph store or second KB authority. - No ordinary StarIntel product-development work. ## Target topology ```text HackmodeSystemActor +-- ControlActor +-- OperationSupervisor | `-- OperationActor[operation] +-- ProviderSupervisor +-- CaptureSupervisor +-- HackpertSupervisor `-- OutboxActor ``` Operation-local children/refs are scoped by stable operation/run identity. External process ownership flows through typed provider/process-port boundaries. ## Dependency-ordered work graph ### Hackmode-owned slices - [ ] #151 — `hackmoded` bootstrap: service lifecycle, local control boundary, deterministic drain - [ ] #152 — migrate Hackmode actor authority from direct Sento construction to StarLang runtime - [ ] #153 — `OperationSupervisor` + operation-scoped actor topology over canonical state - [ ] migrate provider actor composition while preserving `dispatch-capability` as canonical capability boundary - [ ] migrate capture/IPX actor composition without granting persistence authority - [ ] integrate operation-scoped Hackpert actor sessions without changing passive/active authority - [ ] migrate outbox actor composition with unchanged durable outbox semantics - [ ] wire #14/#17/#20 clients to the daemon protocol instead of client-owned runtime lifetime - [ ] systemd/NixOS service packaging after runtime lifecycle is proven - [ ] restart/recovery proof with no duplicate logical effects or leaked processes - [ ] remove direct Hackmode production Sento actor-system construction once equivalence is green ### Upstream StarLang slices - [ ] `lost-rob0t/star-lang#42` — real actor-system semantic evidence - [ ] `lost-rob0t/star-lang#57` — final `star-supervisor` semantics - [ ] `lost-rob0t/star-lang#58` — final `star-process-port` external process lifecycle - [ ] `lost-rob0t/star-lang#59` — journal/replay/generation fencing/leases after base runtime is final ## Dependency policy When Hackmode needs a missing actor primitive, improve StarLang rather than adding a Hackmode-only supervisor/journal/process runtime. The Hackmode slice waits on or consumes the smallest final-owned StarLang primitive required. Do not block unrelated provider/Hackpert work that can continue behind current typed boundaries while the runtime migration proceeds. ## RED-first acceptance program 1. Start `hackmoded`; connect two independent clients to the same runtime. 2. Open/select an operation without either client creating its own actor system. 3. Dispatch a typed provider job; provider failure is isolated. 4. Start/stop an operation-scoped capture service; external process is reaped. 5. Run passive Hackpert and prove zero dispatch/mutation authority. 6. Run an admitted active Hackpert action and prove it crosses the existing capability/effect boundary. 7. Crash/restart one actor child and prove supervisor semantics without restarting the entire daemon. 8. Restart `hackmoded`; reconstruct live coordination from canonical state without duplicate logical evidence/actions. 9. Shut down gracefully; new jobs are rejected during drain and all actor/process/thread resources terminate. 10. Repository search proves no remaining product path constructs a parallel Hackmode actor system directly. ## Definition of done `hackmoded` is the normal Hackmode runtime owner, StarLang hosts the actor topology, clients reconnect to it, current provider/Hackpert/capture/storage authority invariants remain intact, restart/shutdown are deterministic, and direct Sento construction is no longer a Hackmode product API.

nsaspy referenced this issue

2026-09-02 17:24:37 +00:00

Migrate StarIntel RAGE/ARDR workers into Hackmode cyber/BBP workers #46

nsaspy referenced this issue

2026-09-02 17:24:37 +00:00

Make the Hackpert objective loop open and extensible #47

nsaspy referenced this issue

2026-09-02 17:24:37 +00:00

Embed Prolog-RLM inside Hackpert as the generative/escalation reasoning tier #48

nsaspy referenced this issue

2026-09-02 17:24:46 +00:00

Implement Hackpert active engine orchestration and canonical state mutation #49