Research and design StarLang resolver effect ports #110

Merged

lost-rob0t merged 4 commits from agent/star-resolver-ports into main

2026-08-13 05:06:14 +00:00

lost-rob0t commented

2026-08-13 04:58:05 +00:00

(Migrated from github.com)

Scope

Add the next StarLang resolver research/design pass:

STAR-LANG-RESEARCH-016 audits the current curl/sha256sum loader boundary and evaluates injected Common Lisp fetch/digest ports
STAR-LANG-005 specifies the resolver context, port contracts, cache/integrity ordering, security policy, failure contract, packaging direction, and a two-phase migration

Key direction

Phase 1 is dependency-free: extract explicit fetch/digest ports and move current shell behavior behind compatibility adapters, with deterministic fake-port tests.

Phase 2 replaces those adapters with native Common Lisp implementations: Ironclad for SHA-256 and a bounded HTTPS adapter, with Dexador as the current candidate pending implementation validation.

The compiler/runtime remain network/process-free. Remote bytes must be bounded and digest-verified before parsing/compilation.

Evidence

Primary-source review covers the current StarLang loader, approved STAR-LANG-RESEARCH-006, Ironclad documentation, and Dexador documentation.

Both documents remain REVIEW; this PR does not invent approval or claim implementation is complete.

## Scope Add the next StarLang resolver research/design pass: - `STAR-LANG-RESEARCH-016` audits the current `curl`/`sha256sum` loader boundary and evaluates injected Common Lisp fetch/digest ports - `STAR-LANG-005` specifies the resolver context, port contracts, cache/integrity ordering, security policy, failure contract, packaging direction, and a two-phase migration ## Key direction Phase 1 is dependency-free: extract explicit fetch/digest ports and move current shell behavior behind compatibility adapters, with deterministic fake-port tests. Phase 2 replaces those adapters with native Common Lisp implementations: Ironclad for SHA-256 and a bounded HTTPS adapter, with Dexador as the current candidate pending implementation validation. The compiler/runtime remain network/process-free. Remote bytes must be bounded and digest-verified before parsing/compilation. ## Evidence Primary-source review covers the current StarLang loader, approved `STAR-LANG-RESEARCH-006`, Ironclad documentation, and Dexador documentation. Both documents remain `REVIEW`; this PR does not invent approval or claim implementation is complete.