EPIC: Hackmode dogfood — service-grade StarLang actor/runtime #55

New issue

Open

opened 2026-09-02 17:26:05 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-02 17:26:05 +00:00

Owner

Goal

Make Hackmode's always-running hackmoded service a first-class production dogfood consumer of final StarLang actor/runtime systems.

Hackmode ADR: lost-rob0t/hackmode#149
Hackmode implementation epic: lost-rob0t/hackmode#150

Current StarLang main inspected: 0472ed8f4472252038b62bb19a17aa09d2ddf1b4.

Why this epic exists

StarLang already targets the right systems (starlang-runtime, star-mailbox, star-supervisor, star-process-port, star-journal, star-lease, star-capability, star-sento-compat) but the migration ledger still marks important service-grade behavior as PARTIAL/PROTOTYPE/SURFACE ONLY.

Hackmode is an ideal concrete consumer because it needs:

a continuously running Common Lisp host;
multiple operation-scoped actors;
provider/capture/browser/expert actor trees;
external process supervision;
bounded mailboxes/concurrency;
restart/generation/stale-ref semantics;
deterministic shutdown;
durable recovery without moving application persistence into the runtime.

This epic does not create Hackmode-specific semantics inside StarLang. It uses Hackmode as a demanding acceptance workload for generic final runtime behavior.

Existing upstream authority

Coordinate rather than duplicate:

#42 — real actor systems invariant for actor-semantic tests;
#47 — productionize StarLang and retire prototype authority;
#52 — prove final-system port complete, then delete prototype/;
#53 — production embedding/readiness work for long-lived Common Lisp consumers where applicable.

This epic narrows the Hackmode service acceptance profile and adds executable child slices for gaps that were previously only rows/checklists in larger migration epics.

Dependency-ordered child slices

#42 — concrete actor-system semantic evidence and Sento lifecycle equivalence
#57 — final star-supervisor semantics for long-lived service actor trees
#58 — final star-process-port lifecycle for supervised external tool actors
#59 — durable journal/replay/generation fencing/leases after the base runtime/supervisor path is green
stable final embedding/runtime lifecycle API sufficient for Hackmode #152, coordinated with #47/#52/#53 rather than duplicated
generic Hackmode-shaped service topology fixture in the final test matrix
published minimum final-system dependency set for a host like hackmoded

Required Hackmode service profile

Runtime lifecycle

explicit instance creation/configuration;
program load/start/stop/shutdown;
multiple runtimes possible in one image even though hackmoded normally owns one;
no process-global implicit actor authority;
runtime generation changes across restart;
stale refs fail closed;
deterministic join/reap on shutdown.

Supervision

root/supervisor tree;
permanent/transient/temporary semantics;
bounded restart intensity/backoff;
child failure isolation;
no restart storm;
shutdown/drain semantics that fence late results.

External processes

typed process-port ownership;
start/readiness/stop/reap;
stdout/stderr/result classification without unbounded buffering;
deadline/cancellation;
process generation/provenance;
no arbitrary shell callback embedded in portable StarLang IR.

Durable recovery

runtime coordination can recover/replay generic actor-runtime state where appropriate;
application business state remains owned by the host (Hackmode/Tek9);
idempotency/generation/fencing prevents replay from silently committing stale effects;
journal/lease features are generic runtime primitives, not application persistence.

Backend compatibility

StarLang semantics remain authoritative;
Sento/cl-gserver translation stays in star-sento-compat;
real Sento actor integration tests count as concrete backend evidence per #42;
Hackmode never needs to call raw Sento APIs to obtain supported StarLang semantics.

Dogfood acceptance topology

Use a generic fixture equivalent to Hackmode's target topology without importing Hackmode product code:

SystemActor
  +-- OperationSupervisor
  |     +-- OperationActor[A]
  |     `-- OperationActor[B]
  +-- ProviderSupervisor
  |     `-- bounded workers
  +-- ProcessSupervisor
  |     `-- fake external process actor
  `-- ExpertSupervisor

Required proof:

bounded tell/ask and serialized state;
child crash isolation;
supervised restart with generation advance;
stale ref rejection;
bounded worker fan-out without spawn storm;
external process cancellation/reap;
one operation drains while another continues;
runtime restart/recovery does not replay a stale completion into the new generation;
full shutdown leaves no actor/thread/process leak.

Boundaries

no Hackmode/Tek9 semantics in StarLang;
no StarIntel persistence/auth/runtime product work;
no second actor implementation beside the final runtime;
no arbitrary host callbacks/raw Common Lisp objects in portable IR;
do not claim supervision/journal/lease/process semantics final until real final-system tests prove them.

Definition of done

Hackmode can implement lost-rob0t/hackmode#152 using released/final StarLang systems only for all supported actor semantics, with Sento hidden behind star-sento-compat, deterministic service lifecycle, real supervision/process evidence, stale-ref safety and no leaked runtime resources.

## Goal Make Hackmode's always-running `hackmoded` service a first-class production dogfood consumer of final StarLang actor/runtime systems. Hackmode ADR: `lost-rob0t/hackmode#149` Hackmode implementation epic: `lost-rob0t/hackmode#150` Current StarLang `main` inspected: `0472ed8f4472252038b62bb19a17aa09d2ddf1b4`. ## Why this epic exists StarLang already targets the right systems (`starlang-runtime`, `star-mailbox`, `star-supervisor`, `star-process-port`, `star-journal`, `star-lease`, `star-capability`, `star-sento-compat`) but the migration ledger still marks important service-grade behavior as PARTIAL/PROTOTYPE/SURFACE ONLY. Hackmode is an ideal concrete consumer because it needs: - a continuously running Common Lisp host; - multiple operation-scoped actors; - provider/capture/browser/expert actor trees; - external process supervision; - bounded mailboxes/concurrency; - restart/generation/stale-ref semantics; - deterministic shutdown; - durable recovery without moving application persistence into the runtime. This epic does not create Hackmode-specific semantics inside StarLang. It uses Hackmode as a demanding acceptance workload for generic final runtime behavior. ## Existing upstream authority Coordinate rather than duplicate: - #42 — real actor systems invariant for actor-semantic tests; - #47 — productionize StarLang and retire prototype authority; - #52 — prove final-system port complete, then delete `prototype/`; - #53 — production embedding/readiness work for long-lived Common Lisp consumers where applicable. This epic narrows the **Hackmode service acceptance profile** and adds executable child slices for gaps that were previously only rows/checklists in larger migration epics. ## Dependency-ordered child slices - [ ] #42 — concrete actor-system semantic evidence and Sento lifecycle equivalence - [ ] #57 — final `star-supervisor` semantics for long-lived service actor trees - [ ] #58 — final `star-process-port` lifecycle for supervised external tool actors - [ ] #59 — durable journal/replay/generation fencing/leases after the base runtime/supervisor path is green - [ ] stable final embedding/runtime lifecycle API sufficient for Hackmode `#152`, coordinated with #47/#52/#53 rather than duplicated - [ ] generic Hackmode-shaped service topology fixture in the final test matrix - [ ] published minimum final-system dependency set for a host like `hackmoded` ## Required Hackmode service profile ### Runtime lifecycle - explicit instance creation/configuration; - program load/start/stop/shutdown; - multiple runtimes possible in one image even though `hackmoded` normally owns one; - no process-global implicit actor authority; - runtime generation changes across restart; - stale refs fail closed; - deterministic join/reap on shutdown. ### Supervision - root/supervisor tree; - permanent/transient/temporary semantics; - bounded restart intensity/backoff; - child failure isolation; - no restart storm; - shutdown/drain semantics that fence late results. ### External processes - typed process-port ownership; - start/readiness/stop/reap; - stdout/stderr/result classification without unbounded buffering; - deadline/cancellation; - process generation/provenance; - no arbitrary shell callback embedded in portable StarLang IR. ### Durable recovery - runtime coordination can recover/replay generic actor-runtime state where appropriate; - application business state remains owned by the host (Hackmode/Tek9); - idempotency/generation/fencing prevents replay from silently committing stale effects; - journal/lease features are generic runtime primitives, not application persistence. ### Backend compatibility - StarLang semantics remain authoritative; - Sento/cl-gserver translation stays in `star-sento-compat`; - real Sento actor integration tests count as concrete backend evidence per #42; - Hackmode never needs to call raw Sento APIs to obtain supported StarLang semantics. ## Dogfood acceptance topology Use a generic fixture equivalent to Hackmode's target topology without importing Hackmode product code: ```text SystemActor +-- OperationSupervisor | +-- OperationActor[A] | `-- OperationActor[B] +-- ProviderSupervisor | `-- bounded workers +-- ProcessSupervisor | `-- fake external process actor `-- ExpertSupervisor ``` Required proof: 1. bounded tell/ask and serialized state; 2. child crash isolation; 3. supervised restart with generation advance; 4. stale ref rejection; 5. bounded worker fan-out without spawn storm; 6. external process cancellation/reap; 7. one operation drains while another continues; 8. runtime restart/recovery does not replay a stale completion into the new generation; 9. full shutdown leaves no actor/thread/process leak. ## Boundaries - no Hackmode/Tek9 semantics in StarLang; - no StarIntel persistence/auth/runtime product work; - no second actor implementation beside the final runtime; - no arbitrary host callbacks/raw Common Lisp objects in portable IR; - do not claim supervision/journal/lease/process semantics final until real final-system tests prove them. ## Definition of done Hackmode can implement `lost-rob0t/hackmode#152` using released/final StarLang systems only for all supported actor semantics, with Sento hidden behind `star-sento-compat`, deterministic service lifecycle, real supervision/process evidence, stale-ref safety and no leaked runtime resources.

nsaspy referenced this issue from a commit

2026-09-15 03:07:04 +00:00

ipx: add lossless actor pipeline foundation (#55)