Add typed provider actor runtime and DNS provider foundation #19

Merged

lost-rob0t merged 21 commits from agent/provider-actor-dns-slice into master

2026-08-16 14:17:50 +00:00

lost-rob0t commented

2026-08-16 14:04:29 +00:00

(Migrated from github.com)

Summary

Advances #2 with the reusable provider/capability boundary required before the typed LISH and Emacs clients dispatch recon work.

Core capability protocol

typed capability/provider registry with explicit input/output contracts
deterministic logical provider job IDs
canonical invoke-provider -> finalize-provider-invocation path
provider failures become observable provider-job-result failures
successful outputs are validated and persisted only through discover-asset
repeated provider results collapse onto canonical stored assets
provider persistence protects the dedupe/write section with an explicit lock so synchronous callers cannot race Tek9's fetch/write/change-tracking path; events publish after the lock

Actor runtime

factors shared Sento ownership out of the outbox actor
retains dedicated :outbox work and adds a :providers dispatcher
dispatch-capability returns Sento's Future immediately
provider supervisor fans backend invocations out to short-lived child actors
backend calls may execute concurrently
completed invocations return to the supervisor for ordered Tek9 persistence while retaining parallel provider I/O
sync and async APIs share the same invoke/finalize semantics

First migrated provider: DNS / MassDNS

Replaces retained tools/legacy/recon/dns-up.sh behavior with hackmode-provider-dns:

capability: :dns-resolve
backend: :massdns
MassDNS NDJSON parser retains only NOERROR records
strips terminal DNS dots and carries matching A/AAAA answers into typed domain assets
invokes MassDNS through an argv list via UIOP rather than shell interpolation
resolver path and executable remain backend configuration
no alive.txt, findings file, or other parallel state model

Verification

Deterministic tests cover:

typed provider dispatch
canonical operation-store persistence before asset events
duplicate output collapse
deterministic repeated job identity
isolated backend failure
asynchronous Future dispatch through worker -> supervisor completion
MassDNS NOERROR/NXDOMAIN parsing
MassDNS provider success, dedupe, and failure without live DNS traffic

The migration inventory now marks dns-up.sh replaced. Remaining #2 ports stay open, with Nmap next.

Refs #2. Unblocks the provider dependency for #14.

## Summary Advances #2 with the reusable provider/capability boundary required before the typed LISH and Emacs clients dispatch recon work. ### Core capability protocol - typed capability/provider registry with explicit input/output contracts - deterministic logical provider job IDs - canonical `invoke-provider -> finalize-provider-invocation` path - provider failures become observable `provider-job-result` failures - successful outputs are validated and persisted only through `discover-asset` - repeated provider results collapse onto canonical stored assets - provider persistence protects the dedupe/write section with an explicit lock so synchronous callers cannot race Tek9's fetch/write/change-tracking path; events publish after the lock ### Actor runtime - factors shared Sento ownership out of the outbox actor - retains dedicated `:outbox` work and adds a `:providers` dispatcher - `dispatch-capability` returns Sento's Future immediately - provider supervisor fans backend invocations out to short-lived child actors - backend calls may execute concurrently - completed invocations return to the supervisor for ordered Tek9 persistence while retaining parallel provider I/O - sync and async APIs share the same invoke/finalize semantics ### First migrated provider: DNS / MassDNS Replaces retained `tools/legacy/recon/dns-up.sh` behavior with `hackmode-provider-dns`: - capability: `:dns-resolve` - backend: `:massdns` - MassDNS NDJSON parser retains only `NOERROR` records - strips terminal DNS dots and carries matching A/AAAA answers into typed `domain` assets - invokes MassDNS through an argv list via UIOP rather than shell interpolation - resolver path and executable remain backend configuration - no `alive.txt`, findings file, or other parallel state model ### Verification Deterministic tests cover: - typed provider dispatch - canonical operation-store persistence before asset events - duplicate output collapse - deterministic repeated job identity - isolated backend failure - asynchronous Future dispatch through worker -> supervisor completion - MassDNS NOERROR/NXDOMAIN parsing - MassDNS provider success, dedupe, and failure without live DNS traffic The migration inventory now marks `dns-up.sh` replaced. Remaining #2 ports stay open, with Nmap next. Refs #2. Unblocks the provider dependency for #14.