nsaspy/hackmode

Fork 0

ADR: hackmoded is the long-lived Hackmode host; StarLang owns actor semantics #28

New issue

Open

opened 2026-09-02 17:24:35 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-02 17:24:35 +00:00

Owner

Status

Accepted architecture direction from operator discussion on 2026-08-31. This issue is the Hackmode-side decision record and implementation authority for the actor-service migration.

Current Hackmode master inspected: 40389abcc10ad561be76219a4e665bc873fcc2de.

Decision

Hackmode will run as a continuously available local service, provisionally named hackmoded.

hackmoded hosts one long-lived StarLang runtime instance and loads the Hackmode actor topology into that runtime. StarLang becomes the semantic actor/runtime boundary for Hackmode. Sento/cl-gserver may remain the concrete backend during migration, but Hackmode product code must not depend directly on Sento semantics once the StarLang boundary is available.

The intended ownership is:

systemd / NixOS
      |
      v
   hackmoded
      |
      v
StarLang runtime
      |
      +-- HackmodeSystemActor
      |     +-- OperationSupervisor
      |     +-- ProviderSupervisor
      |     +-- CaptureSupervisor
      |     +-- HackpertSupervisor
      |     `-- OutboxActor
      |
      v
star-sento-compat (backend adapter, when selected)
      |
      v
Sento / cl-gserver

Authority boundaries

StarLang owns

actor definitions and references;
mailbox semantics and bounds;
actor topology;
supervision/restart policy;
message routing/lifecycle semantics;
runtime lifecycle and shutdown;
process-port semantics for supervised external tools;
later journal/replay/lease semantics where final-owned.

Hackmode owns

operation semantics;
capability/provider registry and typed provider inputs/results;
Hackpert objective/action/evidence semantics;
capture/IPX semantics;
typed Common Lisp validation and canonical mutation APIs;
LISH/Emacs/local control protocol;
composition/configuration of the Hackmode StarLang program.

Tek9 / canonical Hackmode storage owns

durable operation state;
graph/evidence persistence;
operational/long-term/global KB persistence;
replay/index/compaction/storage conflict semantics.

Actor-local state is live coordination state, not a replacement operation database.

Why

Hackmode already has a direct Sento actor system and provider supervisor, while StarLang is explicitly becoming a Common Lisp durable actor runtime with mailbox, supervision, capability, process-port, journal and lease systems. Making Hackmode a serious StarLang consumer avoids building a second Hackmode-only scheduler/runtime and creates a real production workload that hardens StarLang.

The migration also gives Hackmode one service lifetime instead of CLI-owned actor lifetimes. LISH, Emacs, Nyxt and other clients become clients of the same runtime rather than starting independent actor systems.

Service lifecycle

hackmoded must:

start from explicit configuration;
load/instantiate the Hackmode StarLang program;
expose readiness/health and a local control boundary;
recover operation-local coordination from canonical state after restart;
drain deterministically on shutdown;
stop accepting new runs before final drain;
stop/reap external process actors;
leave no actor/process/thread leaks.

Systemd/NixOS may keep the process alive with normal service supervision. StarLang still owns the internal actor supervision tree; systemd is not the per-actor scheduler.

Message/API direction

Actor messages must be typed and operation/run scoped. Examples include:

ProviderRequest / ProviderResult;
CaptureStarted / CaptureStopped;
HttpExchangeObserved;
ObjectiveChanged;
ExpertActionProposed / ExpertActionAdmitted / ExpertActionRejected;
RunStopped.

Messages carry stable IDs/correlation/provenance, not raw database handles, browser processes, Sento actor objects or secret-bearing ambient state.

Hackpert invariant

A continuously running Hackpert actor gains no implicit authority.

Passive mode remains reasoning-only. Active mode still emits explicit typed actions that Common Lisp validates and routes through canonical capability/provider/Tek9 boundaries. Direct and symbolic reasoning converge on the same effect boundary. No Prolog shell escape or second executor is introduced.

Migration rule

Do not big-bang rewrite the runtime.

establish service/embedding boundaries;
introduce a StarLang-backed Hackmode runtime adapter;
move current direct Sento creation behind that boundary;
migrate actor families incrementally while preserving semantics/tests;
delete direct Hackmode production Sento authority once equivalent StarLang paths are proven;
use each missing StarLang primitive as an upstream dependency slice instead of inventing a Hackmode-local substitute.

Non-goals

no second operation database;
no StarLang-owned Tek9 mutation authority;
no generic workflow engine beside the actor runtime;
no requirement to remove Sento immediately;
no StarIntel product-development work;
no CLI process acting as the runtime owner.

Acceptance decision

The migration is architecturally complete when Hackmode clients can reconnect to a long-lived hackmoded, all product actor semantics flow through StarLang/final runtime boundaries, external tools are supervised through typed process/provider ports, operation state survives daemon restart through canonical storage/recovery, and direct Sento construction is no longer Hackmode product authority.

## Status Accepted architecture direction from operator discussion on 2026-08-31. This issue is the Hackmode-side decision record and implementation authority for the actor-service migration. Current Hackmode `master` inspected: `40389abcc10ad561be76219a4e665bc873fcc2de`. ## Decision Hackmode will run as a continuously available local service, provisionally named **`hackmoded`**. `hackmoded` hosts one long-lived StarLang runtime instance and loads the Hackmode actor topology into that runtime. StarLang becomes the semantic actor/runtime boundary for Hackmode. Sento/cl-gserver may remain the concrete backend during migration, but Hackmode product code must not depend directly on Sento semantics once the StarLang boundary is available. The intended ownership is: ```text systemd / NixOS | v hackmoded | v StarLang runtime | +-- HackmodeSystemActor | +-- OperationSupervisor | +-- ProviderSupervisor | +-- CaptureSupervisor | +-- HackpertSupervisor | `-- OutboxActor | v star-sento-compat (backend adapter, when selected) | v Sento / cl-gserver ``` ## Authority boundaries ### StarLang owns - actor definitions and references; - mailbox semantics and bounds; - actor topology; - supervision/restart policy; - message routing/lifecycle semantics; - runtime lifecycle and shutdown; - process-port semantics for supervised external tools; - later journal/replay/lease semantics where final-owned. ### Hackmode owns - operation semantics; - capability/provider registry and typed provider inputs/results; - Hackpert objective/action/evidence semantics; - capture/IPX semantics; - typed Common Lisp validation and canonical mutation APIs; - LISH/Emacs/local control protocol; - composition/configuration of the Hackmode StarLang program. ### Tek9 / canonical Hackmode storage owns - durable operation state; - graph/evidence persistence; - operational/long-term/global KB persistence; - replay/index/compaction/storage conflict semantics. Actor-local state is live coordination state, not a replacement operation database. ## Why Hackmode already has a direct Sento actor system and provider supervisor, while StarLang is explicitly becoming a Common Lisp durable actor runtime with mailbox, supervision, capability, process-port, journal and lease systems. Making Hackmode a serious StarLang consumer avoids building a second Hackmode-only scheduler/runtime and creates a real production workload that hardens StarLang. The migration also gives Hackmode one service lifetime instead of CLI-owned actor lifetimes. LISH, Emacs, Nyxt and other clients become clients of the same runtime rather than starting independent actor systems. ## Service lifecycle `hackmoded` must: - start from explicit configuration; - load/instantiate the Hackmode StarLang program; - expose readiness/health and a local control boundary; - recover operation-local coordination from canonical state after restart; - drain deterministically on shutdown; - stop accepting new runs before final drain; - stop/reap external process actors; - leave no actor/process/thread leaks. Systemd/NixOS may keep the process alive with normal service supervision. StarLang still owns the internal actor supervision tree; systemd is not the per-actor scheduler. ## Message/API direction Actor messages must be typed and operation/run scoped. Examples include: - `ProviderRequest` / `ProviderResult`; - `CaptureStarted` / `CaptureStopped`; - `HttpExchangeObserved`; - `ObjectiveChanged`; - `ExpertActionProposed` / `ExpertActionAdmitted` / `ExpertActionRejected`; - `RunStopped`. Messages carry stable IDs/correlation/provenance, not raw database handles, browser processes, Sento actor objects or secret-bearing ambient state. ## Hackpert invariant A continuously running Hackpert actor gains no implicit authority. Passive mode remains reasoning-only. Active mode still emits explicit typed actions that Common Lisp validates and routes through canonical capability/provider/Tek9 boundaries. Direct and symbolic reasoning converge on the same effect boundary. No Prolog shell escape or second executor is introduced. ## Migration rule Do not big-bang rewrite the runtime. 1. establish service/embedding boundaries; 2. introduce a StarLang-backed Hackmode runtime adapter; 3. move current direct Sento creation behind that boundary; 4. migrate actor families incrementally while preserving semantics/tests; 5. delete direct Hackmode production Sento authority once equivalent StarLang paths are proven; 6. use each missing StarLang primitive as an upstream dependency slice instead of inventing a Hackmode-local substitute. ## Non-goals - no second operation database; - no StarLang-owned Tek9 mutation authority; - no generic workflow engine beside the actor runtime; - no requirement to remove Sento immediately; - no StarIntel product-development work; - no CLI process acting as the runtime owner. ## Acceptance decision The migration is architecturally complete when Hackmode clients can reconnect to a long-lived `hackmoded`, all product actor semantics flow through StarLang/final runtime boundaries, external tools are supervised through typed process/provider ports, operation state survives daemon restart through canonical storage/recovery, and direct Sento construction is no longer Hackmode product authority.

nsaspy referenced this issue

2026-09-02 17:24:37 +00:00

Migrate StarIntel RAGE/ARDR workers into Hackmode cyber/BBP workers #46

nsaspy referenced this issue

2026-09-02 17:24:37 +00:00

Make the Hackpert objective loop open and extensible #47

nsaspy referenced this issue

2026-09-02 17:24:46 +00:00

Implement Hackpert active engine orchestration and canonical state mutation #49

nsaspy referenced this issue

2026-09-04 20:37:22 +00:00

Add two non-overlapping Hackmode Auto-RAGE development workers #136