P1 proposal: bounded playbook/fan-out orchestration IR #50

New issue

Open

opened 2026-08-29 10:27:54 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-08-29 10:27:54 +00:00

Owner

State

AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL

This issue is a proposed implementation slice derived from Auto-Research design lost-rob0t/starintel-auto-research#172 and does not authorize implementation.

Problem

Current StarLang domain-server/runtime primitives support typed messages, tools, mailboxes, capabilities, lifecycle controls and durable execution, but StarIntel OSINT domains still lack a closed reusable orchestration IR for bounded multi-provider fan-out, typed result bindings, branch-on-outcome and partial aggregation.

Without this slice, Identity, Infrastructure, Source Acquisition and researcher actors will each reimplement concurrency/orchestration policy.

Scope

Add the smallest closed StarLang orchestration surface needed for:

playbook declaration identity/version;
bounded fan-out over an authorized capability/provider set;
typed step/result bindings;
branch-on-known typed outcomes;
bounded aggregation preserving per-branch outcome/provenance identity;
total orchestration budget: positive ceilings for branches, operations/items/bytes and deadline;
cancellation fencing so late branches cannot mutate completed/newer state;
normalized runtime-neutral IR only.

This slice does not add:

provider registry persistence/health/circuit breakers;
scheduling/cron;
Tor/proxy policy;
correlation/expert rules;
dedupe/change detection;
recursive pivot implementation beyond interfaces required to compose with the separate #171 traversal work;
arbitrary host callbacks or a generic workflow engine.

Dependencies

Design authority: lost-rob0t/starintel-auto-research#172
Coordinate with Source Acquisition design lost-rob0t/starintel-auto-research#171 so budget/visited/traversal concepts do not fork.
Existing StarLang runtime/conformance work remains authoritative; do not bypass current parser/compiler/runtime-neutral IR rules.

Mandatory RED-first target

Before any production mutation, add a valid fixture representing a bounded playbook such as:

(playbook enumerate-identity
  (:input identity-seed
   :emits account-observation
   :budget (:branches 8 :items 100 :deadline-ms 10000))
  (fan-out provider from (capabilities identity.account-probe)
    (:max 8 :concurrency 4)
    (call provider probe seed -> result))
  (collect result
    (:outcomes (success partial blocked failed))
    -> observations))

Run it against untouched current main and record a legitimate RED failure because the closed parser/compiler has no playbook/fan-out orchestration declaration.

Negative RED fixtures must also prove rejection of:

fan-out without a positive max;
unknown outcome branches;
raw credential literals;
arbitrary Common Lisp/host function names;
aggregation without a total budget.

A malformed fixture or environment failure does not count as RED.

Acceptance

compiler emits closed runtime-neutral IR for the bounded orchestration forms;
every fan-out has static positive limits and runtime aggregate budget enforcement;
provider/cause/result identity survives aggregation;
partial remains visible rather than becoming success/not-found;
cancellation prevents stale/late branch result commits;
no new generic scheduler/workflow engine appears;
current ASDF/Nix full deterministic gate remains green;
focused PR documents RED then GREEN evidence.

Implementation approval

PENDING / AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL

Only explicit operator approval may move this into RAGE execution.

## State `AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL` This issue is a proposed implementation slice derived from Auto-Research design `lost-rob0t/starintel-auto-research#172` and does **not** authorize implementation. ## Problem Current StarLang domain-server/runtime primitives support typed messages, tools, mailboxes, capabilities, lifecycle controls and durable execution, but StarIntel OSINT domains still lack a closed reusable orchestration IR for bounded multi-provider fan-out, typed result bindings, branch-on-outcome and partial aggregation. Without this slice, Identity, Infrastructure, Source Acquisition and researcher actors will each reimplement concurrency/orchestration policy. ## Scope Add the smallest closed StarLang orchestration surface needed for: - `playbook` declaration identity/version; - bounded `fan-out` over an authorized capability/provider set; - typed step/result bindings; - branch-on-known typed outcomes; - bounded aggregation preserving per-branch outcome/provenance identity; - total orchestration budget: positive ceilings for branches, operations/items/bytes and deadline; - cancellation fencing so late branches cannot mutate completed/newer state; - normalized runtime-neutral IR only. This slice does **not** add: - provider registry persistence/health/circuit breakers; - scheduling/cron; - Tor/proxy policy; - correlation/expert rules; - dedupe/change detection; - recursive pivot implementation beyond interfaces required to compose with the separate #171 traversal work; - arbitrary host callbacks or a generic workflow engine. ## Dependencies - Design authority: `lost-rob0t/starintel-auto-research#172` - Coordinate with Source Acquisition design `lost-rob0t/starintel-auto-research#171` so budget/visited/traversal concepts do not fork. - Existing StarLang runtime/conformance work remains authoritative; do not bypass current parser/compiler/runtime-neutral IR rules. ## Mandatory RED-first target Before any production mutation, add a valid fixture representing a bounded playbook such as: ```lisp (playbook enumerate-identity (:input identity-seed :emits account-observation :budget (:branches 8 :items 100 :deadline-ms 10000)) (fan-out provider from (capabilities identity.account-probe) (:max 8 :concurrency 4) (call provider probe seed -> result)) (collect result (:outcomes (success partial blocked failed)) -> observations)) ``` Run it against untouched current `main` and record a legitimate RED failure because the closed parser/compiler has no `playbook`/`fan-out` orchestration declaration. Negative RED fixtures must also prove rejection of: - fan-out without a positive max; - unknown outcome branches; - raw credential literals; - arbitrary Common Lisp/host function names; - aggregation without a total budget. A malformed fixture or environment failure does not count as RED. ## Acceptance - compiler emits closed runtime-neutral IR for the bounded orchestration forms; - every fan-out has static positive limits and runtime aggregate budget enforcement; - provider/cause/result identity survives aggregation; - `partial` remains visible rather than becoming success/not-found; - cancellation prevents stale/late branch result commits; - no new generic scheduler/workflow engine appears; - current ASDF/Nix full deterministic gate remains green; - focused PR documents RED then GREEN evidence. ## Implementation approval `PENDING / AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL` Only explicit operator approval may move this into RAGE execution.

nsaspy referenced this issue

2026-09-02 17:26:05 +00:00

Browser evidence actor system for bounded screenshot/DOM acquisition #56