build: package the hosted Common Lisp runtime #74

Merged

nsaspy merged 1 commit from feat/hosted-runtime into feat/web-deploy

2026-09-06 19:42:37 +00:00

nsaspy commented

2026-09-06 19:27:19 +00:00

Owner

What

Adds a sandboxed quasar-server package built from ASDF systems and a compressed SBCL saved image with quasar.app:main
Pins Tek9 and the verified starintel-biz host plugin over public Forge HTTPS inputs
Carries the Vite production bundle into the installed ASDF tree so CLOG can serve real assets
Wraps required native libraries, including LMDB and Osicat
Adds environment plumbing for hosted bind address, HTTP/WS ports, and persistent storage path

Boundaries

This does not change Quasar session issuance. The runtime still creates the shared local-user browser token. Public per-user issuance, token suppression/unregister, allowed origins, and shared-origin WebSocket routing remain #71/#72/#73. The deployment consuming this package must keep the entire route behind gateway auth while that shared-token behavior exists.

Verification

nix build .#quasar-server .#quasar-auth-host --no-link
nix flake check
nix develop -c bash scripts/test-lisp
Saved-image process smoke on non-default HTTP/WS ports with CLOG index.html retrieval
prolog-verify check passes with current-HEAD evidence

## What - Adds a sandboxed `quasar-server` package built from ASDF systems and a compressed SBCL saved image with `quasar.app:main` - Pins Tek9 and the verified `starintel-biz` host plugin over public Forge HTTPS inputs - Carries the Vite production bundle into the installed ASDF tree so CLOG can serve real assets - Wraps required native libraries, including LMDB and Osicat - Adds environment plumbing for hosted bind address, HTTP/WS ports, and persistent storage path ## Boundaries This does not change Quasar session issuance. The runtime still creates the shared `local-user` browser token. Public per-user issuance, token suppression/unregister, allowed origins, and shared-origin WebSocket routing remain #71/#72/#73. The deployment consuming this package must keep the entire route behind gateway auth while that shared-token behavior exists. ## Verification - `nix build .#quasar-server .#quasar-auth-host --no-link` - `nix flake check` - `nix develop -c bash scripts/test-lisp` - Saved-image process smoke on non-default HTTP/WS ports with CLOG `index.html` retrieval - `prolog-verify check` passes with current-HEAD evidence

nsaspy added 1 commit

2026-09-06 19:27:19 +00:00