claude
8688a60ded
The single-file ledger had grown to 2968 lines / ~42k tokens, mixing current design law with accreted history: 59 cycle-stamped realization blocks, 18 [HISTORY] passages, 22 supersession markers, and the C10 / C22 / C24 reframe sagas layered several supersessions deep. A code-grounding audit (31 agents, adversarially verified) confirmed 11 defects stated as current truth: stale crate homes from the C28 #288 roster split (cost nodes, PositionManagement, PositionEvent, Session), the renamed InputSpec->PortSpec, the pre-#241 project model in C16 and the open-threads section, a stale HarnessKind retirement deferral in C24, and three C28-internal inconsistencies. New shape, per the ailang precedent: - INDEX.md stays the sole addressable entry point: foundation, external components, a C-id-keyed contract map (one line per contract), and only the genuinely open architectural threads. - contracts/cNN-<slug>.md carries each contract's current truth only: Guarantee / Forbids / Why with ratified refinements integrated, plus a code-anchored Current state. All confirmed defects are fixed here; crate anchors were re-verified against the tree. - contracts/cNN-<slug>.history.md (18 sidecars) and INDEX.history.md preserve every superseded block verbatim, stamps and issue refs intact, under a frozen-record banner. Nothing was deleted: superseded design intent remains an addressable working-tree artifact, off the per-cycle audit walk. - Ledger discipline is now stated in INDEX.md: live files are edited in place at cycle close, superseded text moves verbatim to the sidecar, and a supersession marker in a live file is itself an audit finding. Every contract file was verified against its old text by an independent zero-loss pass (statement-by-statement) plus a code-accuracy spot check; C-ids and contract titles are unchanged, so existing C-id citations in code, tests, and issues resolve as before.
3.2 KiB
C13 — Hot-reload is authoring-only; deploy is frozen
Guarantee. A node/strategy is authored as a native Rust cdylib,
hot-reloaded during the authoring loop (Rust-ABI; host and node built with the
same toolchain). The live/deploy bot is a statically-linked, versioned, frozen
artifact.
Forbids. Hot-swapping a running live bot; loading third-party / foreign- toolchain plugins.
Why. Hot-reload makes the research loop fast; a live artifact must be frozen and reproducible (audit trail: this bot = this commit). A sweep pays no hot-reload tax — params are runtime data (C12), so the cdylib loads once.
Current state
The authoring-loop half is realized; the frozen live/deploy artifact is not yet built.
A research project compiles to an external cdylib exporting one symbol,
AURA_PROJECT, a two-tier #[repr(C)] ProjectDescriptor
(aura-core::project, crates/aura-core/src/project.rs, emitted by the
aura_project! macro). A C tier — magic (AURAPROJ),
descriptor_version, the rustc-version and aura-core-version stamps, the
namespace, all C-compatible field types — is validated before any Rust-ABI
field is touched; a Rust tier — the vocabulary resolver
fn(&str) -> Option<PrimitiveBuilder> and the enumerable type-id list — is read
only once both stamps match. The stamp cannot certify the channel it rides on,
so it does not depend on the Rust ABI it certifies; both stamps are baked at
aura-core compile time (build.rs, per consuming build), so host and dylib each
carry their own side's truth.
"Hot-reload" reads, in v1, as per-invocation load of the freshest build: the
author runs cargo build, and the next aura invocation locates the artifact
via cargo metadata (debug default, --release opt-in) and loads it
load-and-hold — the Library is leaked, never unloaded, so its 'static
strings and fn-pointers stay valid (aura-runner::project::load,
crates/aura-runner/src/project.rs). validate_c_tier checks the four stamps
front-to-back; a mismatch of either version stamp refuses with exit 1 naming
both sides (ProjectError::Incompatible). The project vocabulary is
charter-checked at load (check_charter): non-empty namespace, every id
<ns>::-prefixed, no duplicate, no collision against the std vocabulary,
list↔resolver cross-check — the invariant-9 data-plane discipline (the
C24 enforcement-shift note) enforced at this one
seam.
Scope boundary. Load-and-hold is trivially sound only because the CLI is a one-shot process. A future long-running host — the local-server thread (C22) — must re-solve reload by host restart or subprocess isolation, never in-process unload.
See also
- C12 — params are runtime data, so the cdylib loads once across a sweep
- C16 — engine/project separation; the per-case dependency policy the cdylib boundary serves
- C22 — the long-running host that must re-solve reload
- C24 — the enforcement-shift note whose data-plane discipline the charter check applies