Hybrid Language: Development Plan

Contributor amendment (2026-10-19, #656): current main already rejects direct pointer-receiver calls on map reads, call results, and literals. Apply its existing addressability rule when selecting method values and task callees too, preserving all other receiver rules. Regression suite covers the two residual defects and addressable controls (19 tests); full workspace/corpus/differential and CI verification remain delivery gates.
Contributor validation (2026-10-15): runner now checks linked-worktree Git metadata before setup/commands; wrong SHA and broken gitfile fail closed. Real-worktree regressions plus existing runner/SHA suites: 13 tests passed.

Contributor validation — 2026-10-15

Managed gate now refuses an omitted source list before baseline I/O; empty explicit scans remain valid.
Reproduced four false-success CLI cases on 8fb9238; added regressions and ran all 21 Python tool tests successfully. Rust/compiler suites were not run (Rust is unavailable locally); upstream CI is required before merge.

Status

Contributor check (2026-10-15, EricSpencer00): on base 44a08b9, a successful no-op job declaring a missing results/measurement.json returned exit 0 and summary.ok=true. The runner now checks declared result files before its final verdict, maps the documented results/ prefix to the selected output directory, and exempts its own generated summary. Offline runner/SHA tests cover missing files, real outputs, directories, malformed declarations and summary-only jobs; upstream CI remains required.
Current phase: MVP COMPLETE — G3 REVIEWED + PASSED 2026-10-13 (review delegated by the human; every claim re-verified via standard suites + repo harnesses in a fresh sandbox; 4 findings found + repaired — see Decision Log; Post-MVP queue opened below)
State: MVP done; post-MVP queue open (rows in priority order)
Last session: 2026-10-13, summary: session 8 (G2/G3 review + ratification). Fresh sandbox recovery (clone + toolchain re-pins Go 1.26.9 / Rust 1.99.0, foreground installs). G2 evidence independently reproduced (make bench fast path 3.44 ns ≤ 5 ns, DeepPathCount path-proof). G3 claim-by-claim re-verification: cargo test 194/0, examples 10/10, differential 9/9+11/11, corpus 20/20, go vet/gofmt/clippy. Findings repaired: make bench wired (claimed at Batch J, never landed); Makefile tab regression from Batch I fixed + guards (make check + CI); gofmt over runtime/go + CI hygiene leg; hyrt clippy/unused-import/fmt. Post-MVP queue opened (6 rows). All work committed + pushed.

Environment

OS/arch: Debian 13 (trixie), x86_64, Linux 5.10
Go: go1.26.9 pinned at /home/z/tools/go (do not float)
Rust: 1.99.0 via rustup minimal profile; pinned by tools/env.sh (rust-toolchain.toml lands with the first compiler crate)
C compiler/linker: gcc 14.2.0 (Debian), GNU ld
Hardware (measured 2026-10-11): 2 cores (Xeon, 1 thread/core), 4 GB RAM (SPEC assumed up to 10 GB — CORRECTED), 9.9 GB disk
Kaggle worker (measured, Spike 0): 4 cores (2c×2t Xeon 2.2 GHz — CORRECTED from "reportedly 16"), 30 GB cgroup RAM, internet OK, ~11 s queue, ~50 s round-trip for small jobs, zone europe-west4-c
GitHub Actions (measured, Spike 0): 20/20 concurrent standard runners, 4 vCPU/16 GB each (public repo — matches spec's public-repo guess), ~10–17 s queue, artifacts ~3 KB
Kaggle: CLI 2.2.4, KGAT token at ~/.kaggle/access_token (verified)
GitHub: repo public (push confirmed); no gh CLI — REST via curl (token lives only in .git/config)

Design Decisions in Force

Build-vs-extend: OPTION B (provisional) — Hybrid → Go source; Rust via generated bridge (address-broker + trampolines + staticlib). Scored 59/65 vs A=34, C=37, D=27. Revisit at G0 after Spikes 3–6. 2026-10-11, research/build-vs-extend.md
Go-side output: Go source (Spike 2: 14/14; binary-only ruled out; asm for trampolines with per-arch build-tag gating). 2026-10-11
Cross-boundary memory model: HANDLES (owning-side tables, gen-tagged) + copy-small/pin-large borrows + opt-in scoped arenas (Spike 3, 2026-10-12; P3 fallback pre-registered and fired)
Crossing (Spike 3 redesign): fast path = guard-checked direct call on caller's goroutine stack (2.42 ns, go1.26.9 runtime.g offsets pinned + canary); deep path = bitmap-pooled 1 MiB guarded mmap stacks. Spike 1's shared single mmap stack RETIRED (concurrency-unsafe — real crash found by Spike 3 cleanup test). 2026-10-12
Scheduling model: TWO-TIER (Spike 4, 2026-10-12) — descriptor-flagged blocking callees cross via the entersyscallblock linkname trampoline (stdlib-legal; P-release canary-proven) behind sampler-gated admission (concurrent-syswin ≤ cap + hard thread budget); overflow + high fan-in → bounded blocking pool sized for CONCURRENCY (128/256), generation-tagged tickets, park-backoff poll. M1-on-stack blocking FORBIDDEN for blocking callees (169× starvation). Blocking pools ≠ CPU pools (GOMAXPROCS rule stays for rayon-style pools). Bridge owns the hard thread budget — measured wall: ~717 threads (address-space, this environment).
Ownership model: Tier 0 CONFIRMED for the MVP corpus (Spike 6, 2026-10-12) — 10/10 target programs need zero lifetime annotations / zero managed under the strictest rule reading; Polonius-style checker + rustc as CI oracle (never user-facing); A1–A8 ambiguities → SPEC-LANGUAGE.md; adversarial corpus (shared-mutable-map, sender-keeps-using, borrow-returned) to be added before the checker is built
Crossing design (from Spike 1): asm trampoline + mmap'd guarded stack + address-broker cgo package — replaces the 2017 rustgo cgo_import_static trick which modern Go rejects. Budget: Hybrid→Rust ≤ 5 ns. 2026-10-11
License: dual MIT/Apache-2.0 (SPEC §12 default). 2026-10-11
Makefile over justfile (2-core install cost). 2026-10-11
Implementation language of the compiler: Rust (SPEC §4 default; Kani path). Small crates, cargo check loop in-sandbox, full builds on tiers. 2026-10-11
Job protocol: one job.json + one runner (tools/runner/runner.py) across all three tiers; Kaggle kernel never changes (tools/job.py injects). 2026-10-11

Claims Verification

All SPEC §3 rows verified — see research/claims.md. Headlines: rustygo 127/141 tests + GOMAXPROCS corruption CONFIRMED (0/20 at =4); rustgo repo DELETED, cost CORRECTED to 4.6–5.1 ns (not 40); rust2go async CONFIRMED, ByteDance CONFIRMED-with-nuance; Borgo dead (no license, bus factor 1); TinyGo = black-box only; CXX Option limit CONFIRMED, Crubit CORRECTED (bridges optional); WIT = IDL yes / literal ABI no.

Spike Results

Spike	Threshold	Result	Decision
0 Kaggle	end-to-end works	PASS (42 s round-trip; 4c/30 GB; internet OK)	adopt protocol, corrected facts
0 Actions	4→20 shards merge	PASS (20/20 concurrent, clean merge)	adopt as written
1 call overhead	<10ns / 10–100 / cgo-class	PASS row 1: 2.82 ns sandbox, 4.36 ns worker (safe M4), 0 allocs, race-clean	keep trampoline design; §6 budget → ≤5 ns
2 Go linking	source > asm > objects	PASS 14/14	Go-source emission primary; zero-install via committed source+artifact
3 memory/arena	per pre-registered table	PASS with fallback: P1/P2/P4/P5/P6/P9 green; P3 FAILED (+55 ns pin cost) → copy-small/pin-large; hazards P7/P8 demonstrated	handles + gen-tags + pinned-large-borrow; abi-types.md draft
4 scheduling	per pre-registered table	PASS (both tiers): S1 starvation theory-exact at 1k/10k/100k; S2 worker 100k: M2b 1.00–1.19× M0 on every cell (pair cost ~0.9 ms intrinsic, design-absorbed); S4 pool at bound on both tiers (19.62 s vs 19.5 s at 100k), zero lost; S5 threads bounded, budgets environment-specific; GC-assist wedge = M1's third indictment	two-tier adopted: syswin lane + bounded pool + sampler-gated thread budget
5 errors	per pre-registered table	PASS all: E1 2.58 ns/0 allocs (two-word HyResult), E2 0 allocs, E3 1 alloc, E4 identity + documented chain loss, E5 abort contract verified	adopt HyResult + sentinel table + wrap-on-demand
6 ownership usability	10 programs, annotation count	PASS: 0 annotations / 0 managed / 0 outside-model (strictest reading; hand-trace); A1–A8 ambiguities + corpus gap recorded	Tier-0 real for MVP corpus; Polonius-style engine + rustc CI oracle

Task List

Blockers

(none)

Risk Register

ID	Risk	Likelihood	Impact	Mitigation / check
R1	Safe cross-boundary call cost far above target	closed (2.8–4.4 ns)	—	Spike 1 done
R2	Go output linking brittle across Go versions	M	M	Go-source emission (spike 2); pin 1.26.9; CI matrix later
R3	Arena/GC interaction unsound	closed (spike 3: storm + sentinel + gen-tags green)	—
R4	Blocking Rust calls starve scheduler	closed (spike 4: M1 169× starvation measured; two-tier adopted)	—
R5	"No visible lifetimes" unrealistic	closed for MVP corpus (spike 6: 10/10 zero annotations; adversarial corpus pending pre-checker)	—
R6	MVP scope too large	M	H	MVP-0 first; cut order §7
R7	Sandbox resource exhaustion (4 GB RAM)	H	H	-j2 + timeouts + tiers (working all session)
R8	Kaggle worker unreliable	closed (verified)	—	Spike 0 done
R9	Actions minutes/ToS	L	M	public repo = free standard minutes; log usage; no abuse
R10	Token leakage into public repo	L	H	.gitignore guards + CI secret scan + never-echo discipline (clean so far)
R11	Go codegen ceiling (GC pauses) misses perf budget	M	M	hot paths via ≤5ns Rust calls; macro-benchmarks at Phase 4

Review Gates

G0: PASSED 2026-10-12 (all six spikes both tiers; spike-report written; build-vs-extend re-run confirms Option B; two open human decisions logged in QUESTIONS.md — sendability reading + thread-budget config — defaults proceed per SPEC §9) | G1: RATIFIED 2026-10-13 (human directed the review; every lowering decision re-checked against T4/E3/E6/C1–C4/M4/O8–O9 + implementation; no redirects; batch order confirmed: 07/08 landed, Phase-2 next — see gates/G1.md header) | G2: PASSED + RATIFIED 2026-10-13 (the LIVE-bridge bench: fast path 3.37 ns ≤ 5 ns budget, path-proven by DeepPathCount instrumentation; the pooled deep path's 19.19 ns shallow-goroutine cost documented as the collision-safety premium; review reproduced the evidence in a fresh sandbox — 3.44 ns — gates/G2.md) | G3: REVIEWED + PASSED 2026-10-13 — THE MVP IS DONE (review delegated by the human; every claim re-verified via the standard suites — cargo test 194/0, examples 10/10, differential 9/9+11/11, corpus 20/20, go vet/gofmt/cargo clippy — plus 4 findings found and repaired: missing make bench, Makefile tab regression, gofmt on 5/9 runtime Go files, hyrt clippy/import; gates/G3.md review record)

Test Results

PR #287 integration closeout (2026-10-18): ported onto upstream e2a5f7d while retaining upstream changes; hy-emit 121 unit + 4 integration tests passed; git diff --check passed.
PR #289 integration closeout (2026-10-18): ported onto upstream e2a5f7d while retaining upstream changes; hy-emit 120 unit + 4 integration tests passed; git diff --check passed.
PR #283 integration closeout (2026-10-18): ported onto upstream e2a5f7d while retaining upstream changes; hy-emit 125 unit + 4 integration tests passed; git diff --check passed.
Checker JSON envelope validation (2026-10-15): reject malformed envelopes and contradictory supplied error/warning counts; retain omitted counts and extra fields. Focused corpus harness suite 14/14; top-level Python tools suite 70/70 in a normal clone. Full compiler/corpus suites not run locally (pinned rustc terminates with SIGBUS); owner CI remains required.
Compiler (session 5): 157 tests green (8 diag + 75+4 parser + 25+2 checker + 48 emit) — corpus 20/20 verdict agreement, tripwire not fired (10.0% / 15.0% vs ~25%)
MVP-0 end-to-end (make examples, go1.26.9): 6/6 PASS — 01-hello exact; 02-cli-cat BOTH paths exact (bytes verbatim / E6 stderr+exit 1); 03-worker-pool exact [2 2 4 6 8 10 12 18]; 04-pipeline-backpressure exact total=204; 07-lru-generics exact (b evicted / a=1); 08-graph-ownership exact (a reaches d: true / d reaches a: false) — wired into CI
Version-pin guard: positive + negative tested (injected hyb-pin drift → DRIFT DETECTED, exit 1)
Spike 1 probes (correctness / 20k-deep recursion / scheduler-migration / GC-hammer / race): PASS on sandbox AND Kaggle worker
Spike 2 emission suite: 14/14 PASS (sandbox)
Spike 3: 11/11 safe probes PASS under -race; P7/P8 hazards demonstrated; medians: fast crossing 2.42 ns, deep switch 3.98 ns, P1 49.9 ns, P2 0.84 ns, P4 14.1 ns, pin/unpin +55.3 ns
Spike 3 worker tier (job 003): all probes green, hazards reproduced identically, thresholds hold, P3 fallback confirmed cross-tier (fast crossing 4.12 ns)
Spike 5: 4/4 probes PASS under -race (incl. panic contract via child SIGABRT); E1 wide crossing 2.58 ns/0 allocs, E2 sentinel 0 allocs, E3 wrap 1 alloc, E6 rust refs 2.05/1.76 ns/iter
Spike 5 worker tier (job 004): all green; alloc verdicts identical cross-tier; two-word return costs +0.03 ns over that tier's fast crossing
Spike 4 sandbox: all canaries + race leg green under -race; M2b two-tier 1.0–1.1× M0 (14/15 cells); M1 169× starvation at (1k,50%,100ms); M3 pool at predicted bound; two-tier thread bound never exceeded; uncapped-M2b crash evidence in spikes/spike4-scheduling/work/m2b-uncapped-crash-trimmed.txt
Spike 4 worker tier (job 005 v9): ALL GREEN (521 s) — 100k matrix: M2b 1.00–1.19× M0 every cell; M1 capped at theory (93% at 120 s); M3 long cell 19.62 s vs 19.5 s predicted; M4 5000 threads zero failures (pids.max 38508); race leg 13.8 s; pair cost ~0.9 ms intrinsic on BOTH tiers (sandbox syscall-interception theory refuted)
Spike 6: 10/10 hand-trace pass (0 annotations / 0 managed / 0 outside-model) — believed (hand-trace), to be machine-checked when the Phase-1 checker exists
Fleet smoke: 4/4 and 20/20 shards green at pinned SHA cd21089 (runs 38163370515, 38163372872)
Actions→Kaggle secret path: kaggle.yml run 38167716652 green (104 s end-to-end)
Differential corpus: RUNNING (Batch I) — accept-side 9/9 (build+run), reject-side 11/11 (checker); FULL AGREEMENT; tracked per run in make differential / CI
G2/G3 review re-verification (fresh sandbox, fresh pinned toolchains): cargo test 194/0 (11 suites) · examples 10/10 · differential 9/9+11/11 · corpus 20/20 (tripwire quiet) · bench fast path 3.44 ns ≤ 5 ns (69%) · go vet clean · gofmt clean (after repair) · hyrt clippy clean (after repair)
Release/community/fleet batch (2026-10-14): differential 3/3 consecutive FULL AGREEMENT after the RUNTIME-HAZARD marker fix; fuzz leg 300/300 invariants held (local smoke); -asan 4/4 + -race 5/5 (local); CI green on 43a8e7e + 4bf1aa7; v0.1.0 artifact smoke-tested from the tarball
Batch M (fail-closed, 2026-10-14): cargo test 206/0 (12 suites) · corpus 20/20 (tripwire quiet: 10.0%/15.0%) · differential 9/9+11/11 FULL AGREEMENT · examples 10/10 · go vet+build+test clean (5 pkgs) · clippy 0 · fmt clean; parser no-hang regressions pinned (malformed select arm, brace mis-nest → clean E0002)

Post-MVP queue (reopened 2026-10-13 at the G3 review — work in priority order; each row lands with its own commit + Decision Log entry)

~~Style-hygiene sweep~~ — DONE 2026-10-13 (commit ec279ed) — cargo clippy --fix + hand fixes + cargo fmt over the compiler workspace: 33 findings all style-level, now ZERO clippy findings workspace-wide (hyrt was already clean); 15× doc-list overindent dedented to clippy's own suggested spans, 2× loop→while-let, to_place→place_of (6 sites), FnShape type alias, callee shorthand, is_reference_alias→matches!; full suite re-run after (194/0, differential 9/9+11/11, corpus 20/20, examples 10/10)
~~Fleet dispatch: sanitizers + fuzzing against the release SHA~~ — DONE 2026-10-14 (job 006, 2 Actions shards, BOTH GREEN) — build-hyb 10.1 s · asan-bridge 21.0 s PASS (go test -asan over jsonbinding/regexbinding/sha3binding/hybridge — ASan's malloc interception instruments the Rust staticlib's heap ops at link time; stable-Rust -Zsanitizer needs nightly: documented cut) · race-bridge 13.1 s PASS (go test -race over all five runtime packages) · fuzz-parser-checker 2.4 s PASS (hyfuzz 800 cases, seed 20261014: 752 clean rejects / 48 clean accepts, NO hangs / NO crashes / NO ICEs — the force-progress sync fix is now fleet-pinned). Shard summary artifact ok:true both shards. Coverage-guided cargo-fuzz + native Rust sanitizers remain the nightly follow-up (documented, not hidden)
Worker-tier bench re-measurement (G2 follow-up #1) — DONE 2026-10-14 (job 007 on the Kaggle tier, 4-core Xeon 2.20 GHz) — VERDICT: MISS, recorded honestly — grown-stack fast path 6.93 ns > 5.00 ns budget (raw trampoline 5.36 ns; go-call floor 3.15 ns; marginal delta 3.78 ns; shallow-goroutine deep path 42.41 ns; binding-newobject 888.5 ns; DeepPathCount path-proof froze at 15100001 — fast path PROVEN taken). Sandbox PASS (3.39 ns) does NOT generalize to this tier: the floor itself is 1.5× slower AND the marginal boundary cost is ~3× (stack-switch touch patterns are hardware-sensitive, not just clock-speed). Interpretation unchanged from gates/G2.md: the budget is a sandbox-tier gate; per-callee budgets (row 4) and the Cut Log row are the follow-ups; no code change implied — the number is the deliverable
Per-callee fast-path stack budgets (G2 follow-up #2; Cut Log row) — DONE 2026-10-14 (Batch P) — three guard classes now: SMALL (1024 B, Cross1S..4S, new asm) / DEFAULT (4096 B, Cross1..4, UNCHANGED — G2's measured evidence stays valid) / DEEP (CrossDeep1..4, the pooled 1 MiB stacks). The class ledger (interfaces/descriptors.md) grounds every curated fn: sha3 = ALL SMALL (fixed-frame permutations); serde_json = split by recursion — parse/clone/drop/serialize walk the value tree (remaining_depth=128, measured ceiling: 127 parses / 128 fails) so 7 fns are DEEP and the pre-row-4 default-route parse was a LATENT OVERFLOW on shallow stacks for deep inputs — a real soundness gap found and closed by the classification (regression tests: DeepCrossCount oracle + 127-deep parse/serialize/release on a stack-constrained goroutine); regex = DEFAULT (argued-bounded, unmeasured — honest). Diagnostic parity: Cross2/3/4 now count deep retries (were silent); DeepCrossCount added (the always-deep route's oracle). Shallow-goroutine fan-in for tiny callees no longer pays the 19-42 ns deep path (guard-class test pins the disagreement window). Tests: overheadbench guard-class tests + jsonbinding deep-nesting tests green; examples 10/10 (05 byte-exact through the DEEP routes); corpus 20/20; differential 9/9+11/11; gofmt/vet clean
~~Package-level Go tests for the runtime~~ — DONE 2026-10-13 (Batch L) — 20 tests across all five packages (hybridge 2, overheadbench 3, jsonbinding 9, regexbinding 3, sha3binding 3): payload fidelity + grown-stack fast-path proof (DeepPathCount frozen) + concurrent crossings; the full jsonbinding handle protocol against the REAL staticlib (parse/round-trip, scalar boxing, move-semantics zeroing, empty-key edge, type-strict getters, array materialization, push); regex raw-\s + validity + invalid-pattern error; NIST SHA3-256 vectors + checksum determinism. go test ./... now reports real tests; wired into the CI hygiene leg
make bench in CI's milestone workflow (G2 follow-up #3) — DONE 2026-10-14 — release-matrix.yml bench job; Actions 4-vCPU tier recorded honestly: fast path 5.30 ns > 5.00 ns budget — MISS on this tier (the bench's exit-on-MISS is by design; a verdict line = the datapoint is the deliverable, the log ships as an artifact). Tier ledger now: sandbox 3.39-3.44 PASS · Actions 4-vCPU 5.30 MISS · Kaggle worker 6.93 MISS — the hardware-sensitivity finding from row 3 confirmed across three tiers; per-tier budgets or a budget re-derivation belongs to the Cut Log's revisit, not a code change
~~Fail-closed checker (Batch M — customer feedback, human directive)~~ — DONE 2026-10-14 (this commit) — Finding 1: unknown types/names no longer pass silently at spawn/send boundaries — HYB-E3005 (rule FC) with an ascribe/chan/managed fix-it menu; Finding 2: task/send inside closure bodies are checked (closures.rs pass), captures stay outside (A5 documented, corpus 10 unaffected); select-recv defines use the channel's element shape instead of manufacturing Unknowns; ascriptions fill inference gaps (never override resolved handles); E8001 escape covers unproven values, counted by --report-managed. BONUS — two parser infinite-loop crashes found by the new tests and fixed (sync_stmt/sync_decl force-progress; malformed select arms and stray braces now yield clean E0002 instead of hanging the compiler). cargo 206/0 · corpus 20/20 · differential 9/9+11/11 · examples 10/10 · go test 5 pkgs · clippy 0 · fmt clean
~~Release engineering~~ — DONE 2026-10-14 (v0.1.0) — tag + GitHub Release "the fail-closed release" with the prebuilt linux-amd64 tarball (hyb binary + runtime/ + INSTALL.md; smoke-tested end-to-end from the tarball before upload); notes state the sharp guarantee + what is NOT guaranteed yet
~~GitHub Discussions + community~~ — DONE 2026-10-14 — Discussions enabled (General/Ideas/Polls/Q&A/Show-and-tell/Announcements), feedback thread #1 in Q&A framed as four concrete problems (safety evidence, release contents, adoption model, hatch ergonomics), labels question+enhancement, kind star/contribute ask, good-advice-gets-merged pledge; repo description + 12 topics set
~~Marketing positioning~~ — DONE 2026-10-14 (README 6550cab) — lead: "Just add a .hy file. It's still Go — Hybrid is what Go can safely do."; new section answers "what exactly does this compiler guarantee about my code?" with the fail-closed contract; stale pre-MVP text replaced with live state
Multi-platform release matrix (Discussion #1 ask 2) — DONE 2026-10-14 (run 6: ALL LEGS GREEN + published) — release-matrix.yml: linux/amd64 (reproducible rebuild) · darwin/arm64 (macos-14 native) · windows/amd64 (the bridge under x86_64-pc-windows-gnu — msvc emits hyrt.lib; the cgo contract is -lhyrt → libhyrt.a via mingw ld) · linux/arm64 (aarch64 cross + qemu-static sysroot smoke) — every leg smoke-tests the ACTUAL tarball rustless before anything uploads; all four tarballs + sha256 live on the release. Honest cut: linux/arm64 = checker+emitter only (the bridge asm is amd64-only → row 16); the release table says so per asset. Fleet debugging trail (4 runs, each fix real): BSD paste → aarch64 sysroot → windows-gnu toolchain → qemu -static naming → HYB-E9001's found-but-silent rustc now treated as absent
Docker image for CI (Discussion #1 ask 2) — DONE 2026-10-14 (Batch T) — multi-stage Dockerfile: rust:1.99.0-slim-bookworm builds hyb + the hyrt staticlib (the pins ARE the base images), golang:1.26.9-bookworm carries the runtime — /usr/local/bin/hyb + /opt/hybrid/runtime/ (bindings + bridge sources + the prebuilt libhyrt.a, mtime-freshness contract applied in-image, same as package_release.sh) + ENV HYB_RUNTIME_DIR=/opt/hybrid/runtime (the row-16 discovery lesson makes ENV the right wiring — the CARGO_MANIFEST_DIR fallback never survives into an image). .dockerignore keeps the context lean + secret-free (mirrors the NEVER-COMMIT block). .github/workflows/docker-publish.yml (dispatch-only, like every fleet): build → SMOKE from the actual image (pins + bridge-free 01-hello build&run + the serde_json bridge build&run — cgo links the image's prebuilt staticlib; every container mounts the checkout so binaries survive across docker run invocations) → GHCR push (versioned + latest, GITHUB_TOKEN packages:write). Sandbox has no docker daemon — the build+smoke validation is fleet-pinned by design (the workflow refuses to push anything that didn't smoke). README Docker section added
10-minute sample repo against an EXISTING go.mod (Discussion #1 ask 2, sharpest item) — DONE 2026-10-14 (Batch S) — design thread #3 posted with the three candidates + constraints + the stated leaning; design B landed (go:generate, boring and diffable — no replies argued otherwise, thread stays open): hyb generate [--check] [--binding-prefix] <paths...> — parse → check (fail-closed: a rejected .hy NEVER emits) → package inference from sibling .go files (SIBLINGS-AGREE check; none = HYB-E9002 with the fix-it) → emit via the package emitter → gofmt-canonical output (the checked-in file is canonical; run_gofmt derives GOROOT/bin/gofmt so the toolchain is found wherever go works) → <stem>.hy.go with the Code-Generated header + an overwrite guard that refuses to clobber hand-written files. --check re-emits in memory and compares CONTENT: semantic drift = exit 1 with the stale list (comment-only edits correctly do NOT count — the generated Go doesn't depend on them). hyb vendor-runtime <dir>: one boring command producing /hybridrt/ (binding packages + module hybrid.program go.mod + the fresh arch-matched staticlib at lib/) for the two-line go.mod wiring (require + replace). The sample: examples/gomod-integration/ — an ordinary module (go.mod with the two lines, hand-written app.go, calc.hy, checked-in gofmt-canonical calc.hy.go, calc_test.go — Hybrid-checked code covered by ORDINARY go test) — go build/vet/test/run all green, output verified (total: 41), drift detection verified; CI leg exercises the whole recipe + the drift rejection every push. README gained the "existing go.mod project (10 minutes)" section. ~~Emitter base-indent (one tab deeper than gofmt) noted as a documented follow-up — generate's gofmt pass makes it moot for checked-in files.~~ Follow-up CLOSED 2026-10-14 (Batch V) — see the Decision Log: emitted Go is now gofmt-clean at the source for all 10 examples, and hyb build pipes through gofmt for the rest of go/printer's normalizations. Suites: cargo 215/0 · clippy 0 · corpus 20/20 · differential 9/9+11/11 · examples 10/10 · managed gate PASS
managed hardening phase 2 (Discussion #1 ask 4) — DONE 2026-10-14 (Batch R) — design thread POSTED FIRST per the row's own rule (discussion #4: grammar proposal + closed categories + alternatives rejected + "lands with the next batch" bar), then implemented same-session: managed("reason", "category", tickets...) { ... } — string LITERALS only (un-greppable computed payloads rejected at parse); fail-closed policy in the checker (bare block = reject HYB-E0003 naming BOTH missing parts; unknown category = reject HYB-E0004; closed set mutex/atomic/actor/finalizer/interop/other; new registry entries carry the fix-its) — the parser only enforces SHAPE so every violation surfaces through one coded path. --report-managed is now a TABLE: per-category counts + every block's reason/category/tickets (JSON + human); the emitted Go marker carries [category] reason tickets: — greppable in the Go output. The new-block gate: tools/managed_gate.py + committed gates/managed-baseline.json (corpus 02/18 baselined) — a managed block not in the baseline fails CI (ci.yml step), removals always allowed, rebaseline requires review; O6.4 added to SPEC-LANGUAGE.md (LX16 grammar + payload), GUARANTEES.md row 8 rewritten. Corpus 02/18 gained payloads with logged AMENDMENT headers (verdicts unchanged). Suite: cargo 215/0 (+2 policy tests, 2 updated to the payload form) · corpus 20/20 tripwire quiet · differential 9/9+11/11 · examples 10/10 · gate PASS (2 baseline blocks; new-block rejection verified by fixture) · clippy 0
Soundness ledger + bounty decision (Discussion #1 ask 1) — DONE 2026-10-14 (Batch O + owner decision, Batch U) — Batch O landed the ledger half: .github/ISSUE_TEMPLATE/soundness.yml, the soundness label wired, GUARANTEES.md's P0-by-definition publication protocol. The bounty DECISION arrived from the repo owner 2026-10-14 and is now BOUNTY.md: $500 pool, top 10 contributions, ladder $75/$60/$50 then $45 × 7 (owner set the shape: top three take the larger share, 4–10 equal; strict 30% for the top three would have forced 3rd below 4th, so the top-three share lands at ~37% with the owner retaining final say on every payout), severity tiers Critical/High/Medium/Low, pay only after reproduction (a real accepted-but-unsound corpus regression; no theories, duplicates, known issues, or unreproducibles), fix PRs must pass our GitHub Actions before final review, safe-harbor clause, 48-hour triage SLA, first-reporter-takes-the-duplicate rule, AI-assisted reports welcome (judged on verified impact, minimal repros, spam disqualified), all-contributors credit, Hall of Fame (seeded with the Discussion #1 reviewer), the Discord-is-coming note, and the star-and-share ask. Announced in GUARANTEES.md's soundness protocol + the README Contributing section + the v0.1.0 release notes
~~Aarch64 bridge port~~ — DONE 2026-10-14 (Batch Q) — runtime/go/hybridge/call_arm64.s: the full trampoline set (spHeadroom, callFast1..4, callFast1S..4S, callDeep1..4) mirroring the amd64 discipline, with three arch-specific simplifications: (1) g lives in R28 — the guard check reads g.stackguard0 directly, no TLS dance (amd64 needs one); (2) BL pushes no return address and Go keeps SP 16-aligned — the fast path needs NO SP adjustment at all (amd64 does SUB+AND for the SysV gap); (3) the deep path stashes the old SP in a 16-byte scratch slot BELOW the callee's entry SP on the pooled stack — NO Go callee-saved register is borrowed (amd64 borrows RBX). LR (R30) is saved/restored by the assembler's own prologue/epilogue (declared frame > 0), so the amd64-era LR-clobber concern (abi-types §6) does not apply. Offsets pinned honestly: tools/extract_offsets.py (promoted from spike 3) run against an arm64-built binary — g.stackguard0 = 16, cross-checked against cmd/internal/obj/arm64/obj7.go's own 2*PtrSize emission. Validation (all real, not claimed): the full 5-package Go suite (Batch L's 20 tests + the SPHeadroom offsets canary + guard-class tests) cross-compiled GOARCH=arm64 against an ARM64 libhyrt.a and executed under qemu-user — ALL PASS; the packaging script gained a SECOND arm64 smoke leg — a serde_json BRIDGE program built from the actual tarball (cgo links the prebuilt arm64 staticlib; GOARCH=arm64 assembles call_arm64.s) and run under qemu — {"active": ["ada"]} byte-exact. The port flushed out three real release bugs (found by the bridge smoke, fixed in the same batch): (a) runtime_dir() resolved the BUILD machine's CARGO_MANIFEST_DIR — shipped binaries couldn't find their own runtime/ without the install.sh launcher (now: exe-relative tarball layout first, manifest fallback for dev builds); (b) staticlib selection was arch-blind — ensure_staticlib now filters candidates by ELF e_machine (proper ar-archive walk: the 312 KiB Rust symbol-index member defeats a naive head-scan — unit-tested) and picks the freshest arch-matching fresh lib; (c) build_with_bridge (the single-program path) duplicated the staticlib logic naively — ALWAYS cargo-rebuilt natively and copied whatever cargo produced (a foreign-arch lib under cross), reachable even in the rustless smoke via cargo_bin()'s old ~/.cargo/bin fallback — now routed through ensure_staticlib, and the fallback is REMOVED (a freshness failure without cargo fails loudly; the rustless contract is real again). release-matrix arm64 leg gains the required Go-suite-under-qemu regression. Suite re-run after: cargo 212/0 (+2 arch-matcher tests) · corpus 20/20 tripwire quiet · differential 9/9+11/11 FULL AGREEMENT · examples 10/10 · go vet/build/test 5 pkgs (amd64) + 5/5 under qemu (arm64) · clippy 0. linux/arm64 ships FULL (the release table's per-asset cut note is obsolete pending the fleet republish — dispatch rebuilds all four assets from this SHA)
~~Windows bridge port (Win64 trampolines + fleet bridge smoke)~~ — DONE 2026-10-14 — — community benchmark report (v0.1.0, i5-4210M Windows 10) verified bridge-free programs work on Windows but 05/10 "emit Go but fail to link"; three real gaps found and the groundwork landed 2026-10-14 (this commit): (a) the hybridge package could not even COMPILE on Windows — the deep-stack pool lived only in stack_linux.go — now stack_windows.go implements the same pooled guarded stacks via kernel32 VirtualAlloc/VirtualProtect (NewLazyDLL, NO cgo, CGO_ENABLED=0-safe), verified by GOOS=windows go build+vet and pinned by a new CI hygiene step; (b) hyb hardcoded libhyrt.a — now staticlib_candidates probes all toolchain flavors (libhyrt.a / hyrt.lib / libhyrt.lib), lib_arch_matches reads COFF members (IMAGE_FILE_MACHINE_AMD64/AARCH64) beside ELF, the rebuild fallback re-probes instead of assuming a path, install_staticlib lays the .lib aliases, and the nothing-found error names the mingw requirement (3 new hyb tests: COFF accept/reject, alias install, existing ELF cases untouched); (c) 2026-10-14 (adoption-audit batch): call_win64.s WRITTEN — the full trampoline set under the Microsoft x64 convention (args RCX/RDX/R8/R9, 32-byte shadow space at every CALL, 16-alignment, old SP in RBX — non-volatile in Win64, the callee preserves it; NEEDS_DEEP sentinel; deep path on the kernel32 pool), call_amd64.s gated amd64 && !windows so the two never collide, the four binding packages' cgo LDFLAGS split per-OS (-ldl -lm are !windows; windows carries -lwinpthread), the CI windows guard now assembles+vents call_win64.s, and the release matrix's windows leg runs the required Go-suite bridge smoke (5 packages native on the runner, mingw cgo links the GNU staticlib). VALIDATION HERE: GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build+vet PASS; linux 5-pkg suite green. FLEET-PROVEN (run 38600830951, all five legs green): the windows leg ran the full 5-package Go suite NATIVELY through mingw cgo + the GNU staticlib — real crossings through the real trampolines. Getting there found TWO more real ABI bugs beyond the asm itself, both fixed and both recorded because they are exactly the class the next port (any new arch) will hit: (1) six hyrt exports took HyStr {ptr,len} — a 16-byte repr(C) struct — BY VALUE; SysV passes it in the same two integer registers the flat C shims already used, so Linux worked by register-layout ACCIDENT, while Win64 passes any >8-byte struct BY REFERENCE (the fleet hung jsonbinding for the full 10-minute timeout; fixed by flattening every export to two u64s — HyStr stays internal). (2) Go's ABI0 does NOT guarantee 16-byte alignment at call sites — the entry residue varies with the caller's frame layout; two fixed-sub attempts ($40, then $48) each crashed on a different gcc-built callee's first movaps (fleet-bisected via the base-invariant page offset to TestStreamChecksumDeterministic, then hy_sha3_digest256+0x5c) before the trampolines forced alignment like the SysV file always did (ANDQ $-16 + 32-byte shadow). A regression probe (hyrt_stack_alignment_probe + TestStackAlignmentContract) now pins the alignment contract on every platform through the real fast trampoline shapes. README's DO-NOT-ADOPT note lifted (mingw gcc remains the one requirement)
~~Bench precision upgrade~~ — DONE 2026-10-14 (Batch X) — ms-clock harnesses are too coarse for µs alloc tails and 1.4× single-thread hints are "suggestive, not defensible". Land ns-resolution timers + HDR histograms in the bench harnesses and MIRRORED queue shapes between the Go/Rust/Hybrid workload triples (the report's matched-shape control dissolved an 8× "gap" into parity — the harnesses should make that the default, not a manual follow-up). Exit criteria: overheadbench + the workload harnesses emit p50/p99 at ns resolution; the three-language workload triplets share shapes by construction — both met: runtime/go/hybench (HDR-style log-linear histogram, windowed-mean timer-honesty rule pinned in docs + 5 tests), hyb bench-overhead now emits windowed p50/p99 for the fast paths (100×10k) and per-call p50/p99 for the binding call — the first run already surfaced what the mean hid (binding mean 758 ns, p50 483 / p99 1299); the legacy ns/call lines are untouched so G2's evidence format holds; benchmarks/workloads/ emits the Go/Rust/Hybrid triplet from ONE shape.py definition (100 windows, 2000 load items, 32×128×960 B alloc queues) with CI drift mode — first live run: load p50 163/162/112 ns, alloc same ballpark (parity, not a gap); the .hy twins double as checker exercises at scale

Decision Log

2026-10-15 | PR mega-batch: 24 open PRs processed — 20 merged, 1 duplicate closed, 3 queued with written triage; corpus 31→42, cargo 322→398 — the conveyor ran in dependency order: tools/CI honesty first (13 PRs, one battery), parser/emit second (8), the checker stack third (stacked pr-110→117→126 landed in order with per-seam notes, then 142/151/162/140/128/156/157/163). Semantic conflicts resolved with logged decisions, never silent test-weakening: (1) pr-110's accept-side precision tests predated fef40da's closure-boundary use checking — verified against f99d6d0's own checker that the "precision accept" shape was ALREADY rejected on main; amended the two tests to the fail-closed expectation with the reasoning in-file and opened follow-up row (N1-p) for true NLL precision; (2) pr-161 vs pr-150 both fixed #147 — #150 landed (spec-cited usize/isize exclusion + constant folding), #161 closed as duplicate with credit; (3) pr-128's E3001 attribution moved to E3003/E3006 on the merged seam — the test now requires "the post-move violation is diagnosed" (E3001 or E3003); (4) pr-8's corpus program is not expressible in-grammar (task-decl + *deref do not exist) and its rewritten intent ACCEPTS soundly (read-only primitive borrow + Go escape analysis) — honest triage, rewrite invited; (5) pr-22's corpus 25-28 renumbered to 32-35 (slots taken by the audit wave), pr-110's 28→36, pr-117's 29→37, pr-126's 30→38, pr-142's 32→39, pr-162's 32/33→40/41, pr-156's 32→42. Fork-PR workflow approvals batch-approved (44 action_required runs) so every head carries CI. Suites at every boundary: cargo 398/0 · corpus 42/42 · differential FULL (10+29) · examples 10/10 · go 6 pkgs · python 56 · gate PASS | reverse: per-PR revert, never batch | evidence: every merge commit carries the suites it ran
2026-10-15 | Follow-up row (N1-p): NLL-precision for closure captures — pr-110's accept-side precision tests (capture_called_only_before_move_accepts / primitive_capture_after_move_accepts) were written against a base predating fef40da's closure-boundary use checking and never held on main; the integration keeps fef40da's CONSERVATIVE rule (a closure may run at any time after definition, so uses of moved bindings inside closure bodies check against the completed env — fail-closed, amended tests + logged decision in capture_freeze.rs) and defers the precision version (flow-sensitive "can this closure still be called after the move" analysis) to this row | reverse: implement the flow-sensitive analysis, flip the two amended tests back to Accept with proofs
2026-10-15 | Wildcard Track ADDED to the bounty program by the repo owner: another $500 per cycle, separate from the ladder — the owner's design intent, quoted: revolutionary, contrarian, high-risk ideas that a normal feature bounty would reject; breakthroughs not increments; no working prototype required ("a place for us to analyze people's crazy ideas or thoughts"); breaking changes, new paradigms, rewrites, and "impossible" ideas explicitly allowed; failure is a valid outcome if it produces knowledge; the hunt is for unique approaches/additions that make paradigm shifts without breaking everything, with the cost-to-ROI judgment ours. Payout: one wildcard winner per cycle, $250 on acceptance (M1) + $250 when the learning is published (M2) — success or failure alike (a published failure IS the deliverable; a learning publishing in a later cycle rides that cycle's budget). Ops delegated to the AI maintainer per BOUNTY.md's governance: intake triage ≤48h (same as bugs), a public monthly review window (1st), milestone tracking in the MOONSHOT ledger, payout preparation, maintainer final say + written reasons. Landing: BOUNTY.md (intro, track list, Track-3 quick rules, submit step), MOONSHOT.md (ledger + learnings log + failure wall + active-solicitation calendar), .github/ISSUE_TEMPLATE/wildcard.yml (intake), config.yml contact, CONTRIBUTING.md/README/GUARANTEES cross-links, wildcard + moonshot labels; solicitation prompts posted with the announcement (kill the .hy/.go split, replace the borrow machinery, attack the emit target, impossible guarantees, rewrite us) | reverse: owner re-decides budget/cadence; ledger rows already paid are immutable | evidence: process docs self-grounding; the first community entries land through the new template
2026-10-14 | Bench-precision batch (row 18 DONE): hybench + p50/p99 in bench-overhead + the mirrored workload triplet — runtime/go/hybench: HDR-style log-linear histogram (base-2 exponent buckets, 1/1024 sub-buckets, ~0.1% relative resolution from 1 ns to 1 s, flat memory), with the timer-honesty rule pinned in its docs: batched ops record WINDOW means (a per-call time.Now() costs ~20-30 ns and would dominate a 3 ns crossing), slow ops record per call. hyb bench-overhead emits windowed p50/p99 (100 windows x 10k calls) for the fast paths and per-call p50/p99 for the binding call; the legacy <name> <float> ns/call lines are byte-identical so gates/G2.md's evidence format holds. benchmarks/workloads/: shape.py is the single source of shape truth and EMITS go/main.go, rust/src/main.rs, hy/load.hy, hy/alloc.hy (100 windows, 2000 load items, 32x128x960-B alloc queues, identical windowed-mean timing); CI runs shape.py --check so the committed programs cannot drift from the generator; the .hy twins pass hyb check on every run (checker exercise at realistic scale) | reverse: the histogram is a new 6th runtime package (go suite 5→6 pkgs) and the bench gains ~4 s of percentile measurement per run — accepted, the tails are the deliverable | first live triplet: load p50 163 (Go) / 162 (Hybrid) / 112 (Rust) ns, alloc same ballpark across all three — parity by construction
2026-10-14 | Follow-up rows (a)/(b)/(c) from the external audit — ALL LANDED 2026-10-15 — (a) composite-nil: check_composite_nils gives every literal its own per-slot type context (struct fields from the def, map value slots, slice element slots, recursive through nesting); a nested nil rejects E4001 at the define, the rebind, the return, and the boundary — inside managed too (type contract); corpus 28 + 6-shape unit test. (b) flate2 early-fail: UNBOUND_RUST_CRATES + EmitError::unbound_crate — both usage shapes (bare call, explicit import) now refuse at emit time with the honest message (why check passes, why it still cannot build, the audit's pricing, the two paths out); hyb check stays type-pure so corpus 14 keeps grading A7. (c) pin-drift guard: hyb/build.rs — rerun-if-env-changed kills the stale bake; a build whose rustc differs from the pin being baked REFUSES with the three honest ways out (the reporter's vanished-override trap closes at compile time); check-versions syncs build.rs's DEFAULT_PIN
2026-10-15 | The stale family rebased + the PR mega-batch continues — the four carelessdept PRs (#28/#30/#32/#34) were maintainer-rebased onto the accumulated seam with per-PR honest seam notes (subsumed machinery documented as subsumed; live holes ported through the seam's architecture; the authors' tests all landed), CI-validated, and merged; carelessdept's bounty standing preserved. Bookkeeping closes: #41/#56/#58/#59 (changes landed in the previous mega-batch, heads were rebased copies — closed with landing SHAs + credit). Duplicate pairs resolved with both sides credited: #80+#83 (issue #75 — the reporter's message + corpus, the other's root-group union), #81+#82 (issue #79 — identical commits), #78+#86 (issue #77 — the E3007 registry design won, both credited). Fresh ports: pr-24 (loop back-edge, fixes #23) applied via rebase — clean on today's seam; pr-74 (issue #73 call-result laundering) ported with corpus renumbered 31. Suits at every boundary; corpus 27→31; cargo 290→322
2026-10-14 | Adoption-audit batch (external safety audit executed on a fresh checkout): F1 spawn-callee proof + F2 N1 nil emission + F5 fnlit results, corpus 25 — the audit's confirmed false negatives both sourced to code and fixed: F1 (high) the O4.0 site checked only args — task gap() with a closure callee shared its captures with the new task and task mystery(1) passed silently; now the callee is classified (declared top-level fn = proven; closure literal or closure-typed binding = REJECT E3001/A5, local-shadow-aware; unresolvable/computed callee = fail-closed E3005/FC) and the managed("why","actor") hatch remains the auditable route. F2 (medium) HYB-E4001 existed only as registry text; now emitted at every site where the target type is known: ascribed local inits (SPEC's own var s []int = nil), assignments (ident/field/index places), send values (chan element), spawn args (callee param shapes), returns (declared result shapes via a new FnState.result_shapes); nil into error/foreign stays legal (N1/N2), a nil whose target did not resolve is fail-closed E3005 at boundaries, and E4001 fires even inside managed (a TYPE contract, not a sendability doubt). F5 friction: fn literal result types parse per the SPEC EBNF (FuncLit = "fn" [Signature] Block) and emit verbatim — asynq-style gcd closures verified end to end (gcd(48,18)=6 through a fn-typed param). Audit findings already fixed on main before this batch: F4 alias resolution (the scope-aware env). README's flate2 claim removed (the runtime ships sha3/serde_json/regex only — the checker's flate2 table stays: it is the A7 consume-mode fixture; an early-build "not shipped" diagnostic is the follow-up). 17 new checker tests (callee_and_nil.rs) + corpus 25 + SPEC O4.0 extended with the spawn-callee proof | suites: cargo 255/0 · clippy 0 · corpus 25/25 · differential 10/10+15/15 · examples 10/10 · go 5→6 pkgs (hybench joins next batch) · gofmt clean
2026-10-14 | Bounty ops day two: three community PRs merged (#17 new(T) pointer shape, #13 let/T22 class-4, #15 corpus pair) and the reported shadowing P0 fixed (issue #14, corpus 24) — PR #17 (Ratanlavate, issue #16): new(T) was typed Primitive (class-1 sendable), so p := new(pool_stats); task bump(p) shared a *pool_stats across tasks with zero diagnostics and raced under go -race; now TypeShape::Pointer(pointee) with an unresolved-name fallback to Unknown (fail-closed), 3 regression tests; verified locally (hy-check 45, corpus, differential, examples) before the CI-gate merge. PR #13 (Ratanlavate, issue #12): LocalKind::is_immutable() returned true for let AND const, so a let-bound map got the class-4 immutability shortcut and crossed a spawn unproven; the fix restricts the shortcut to const per T22 ("let is SHALLOW") with corpus 21; the merge seam found the SAME hole in the closure pass (closures.rs duplicated the let/const rule) — closed in this batch. PR #15 (muhammet424342, issue #6): a hand-derived A1c pair (live map-slot loan at spawn REJECT + its legal copy twin ACCEPT) — its CI failed ONLY on the stale parse-count test; merged via a local merge commit with a documented seam (files renumbered 22/23, counts bumped); verdicts verified 22/22 + differential 12/12 BEFORE merge. Issue #14 (LubuSeb, REPRODUCED on main before the ack): the checker's binding env was FLAT, so m := 1 inside an if OVERWROTE the outer map's binding and task worker(m) classified the int — zero diagnostics, two write/write DATA RACEs under go -race; fix = scope-aware env (walk.rs emits Push/Pop scope events over the flat list — one implicit scope per if/for per Go, per-body scopes for then/else/loop/managed/match-arm/select-arm/bare-block; defines land in the innermost layer and die at exit; closures.rs mirrors the discipline and its let/const rule; 5 new checker tests + corpus 24). Suites at every boundary: cargo 238/0 · clippy 0 · corpus 24/24 · differential 10/10+14/14 · examples 10/10 · gate PASS · go 5 pkgs · windows guard PASS | reverse: the scope events change binding resolution ONLY (shapes/moves/freeze route through the same lookups as before); a capture of a block-local now fails closed at the closure boundary (was: resolved from the flat env) — this is the A5-documented over-approximation tightened, logged here as the amendment; Hall of Fame updated for all three contributors
2026-10-14 | Community benchmark report (v0.1.0) acted on: the SPEC grammar's bit ops land, mut gets reserved, Windows bridge groundwork lands, two roadmap rows open — the report (i5-4210M, Windows 10, Go 1.26.9 pinned, 193-row CSV, all checksums matched) independently reproduced 215 cargo tests + 20/20 corpus + 10/10 examples and its three "top fixes" all went into the plan: (1) the parser now accepts the FULL SPEC-LANGUAGE 1.4 grammar — | ^ at AddOp level, & << >> at MulOp level, the five compound assigns |= &= ^= <<= >>= (the lexer needed the 3-char forms ordered before their 2-char prefixes), precedence verified against Go's tiers by test, and the report's own *+-LCG workaround now runs as a real xorshift through hyb end-to-end (state + mask checksums hand-verified); (2) mut x := 3 used to PARSE (mut as a plain identifier) and emit the word mut into Go — a broken build from accepted source, exactly the accepted-but-broken class the fail-closed contract forbids — mut is now reserved (LX3 updated: immutability is binding-level let, T22) and fails at parse with the keyword named; (3) the Windows bridge gaps became row 17 (Win64 trampolines + fleet bridge smoke, groundwork landed: stack_windows.go, COFF/staticlib-flavor recognition in hyb, CI windows compile guard) and the bench-precision ask became row 18. README's star ask rewritten per the owner's wording ("Before starting, star the repository") | reverse: bit-op emission is a verbatim Go mapping pinned by tests; mut reservation is a SPEC-amended break of previously-accepted (always broken at Go build) source — logged here as the amendment
2026-10-14 | The bounty pays for the first time: two community PRs merged (#10 soundness + #11 wording) and one triaged honestly (#8) — PR #10 (ocakciomursel-pixel, issue #9): the E3004 registry entry DOCUMENTS jobs <- move s.data as a reject but the checker only enforced the top-level ident form — a GC field move or a move nested in a composite literal crossed a boundary unproven (exactly the accepted-but-unsound class the bounty hunts; reported AND fixed by the contributor with two regression tests pinning the registry's own example; unwrap_parens + collect_move_operands landed in model.rs, the O5.4 move-form check fires E3004 for non-ident GC field moves at spawn/send, move-defines now freeze non-ident sources too). PR #11 (muhammet424342, issue #7): the E3005 fix-it still taught the retired bare managed { ... } form (HYB-E0003 rejects it since Batch R) — now names the real managed("reason", "category") hatch with the closed category list, sendability note + diagnostics.json fixit + regression test. PR #8 (tim777z, the FIRST bounty submission within an hour of the announcement): aimed at the documented D2 open point but the shape is not expressible in today's grammar and the file failed parsing (E0002 x2); the expressible loan-escape is already corpus 06 — kind precise triage with two paths forward, no payout, honest about why. Process held: every PR verified LOCALLY first (full standard suites), CI approved through the action_required gate, merged only after green: merged-main cargo 222/0 (+5 community tests) · clippy 0 (one merge-seam unused import fixed) · corpus 20/20 tripwire quiet · differential FULL AGREEMENT · examples 10/10 · gate PASS. Hall of Fame updated with both landings | reverse: contributor credit is permanent in the hall of fame; reverting the CODE changes needs a new review with the same evidence discipline
2026-10-14 | Batch V: the emitter base-indent sweep (row 13's documented follow-up) — emitted Go is now gofmt-clean at the source — measured first (blast radius: all 10 examples gofmt-unclean, 670 diff lines), then fixed at four roots: (1) emit_fn double-indented fn bodies (it pre-bumped AND emit_block_body supplies its own level — the statement-level contract every other block relies on); (2) struct fields lacked gofmt's name/type column alignment; (3) a leading import decl emits nothing but the between-decls separator still fired → a stray double blank after the import block; (4) loop labels were inline (hyLoop: for {) where gofmt puts them on their own line. The remainder of go/printer's normalizations are deep-expression SPACING heuristics not worth re-implementing — hyb build now pipes the emitted source through the pinned toolchain's own gofmt (cosmetic, semantics-preserving by definition; gofmt failure falls back loudly-but-harmlessly to the unformatted source, go build stays the real gate) — so EVERY Go surface Hybrid hands you is gofmt-canonical: build temp files, --emit-go dumps, generate output. The sweep ALSO caught a real CLI bug: hyb generate --check calc.hy (bare filename) died on read_dir("") because Path::parent() of a bare name is Some("") — normalized to "." and pinned by 2 new integration tests (hyb/tests/generate_paths.rs over bare/.//dir spellings). Evidence: blast radius 670 → 0 diff lines (all 10 examples gofmt-clean); cargo 217/0 (+2 generate-path tests, 1 label-shape test updated to the new canonical form) · clippy 0 at --all-targets (2 pre-existing test-lint findings fixed too: repeat_n, bool_assert) · corpus 20/20 tripwire quiet · differential 9/9+11/11 FULL AGREEMENT · examples 10/10 · go vet/build/test 5 pkgs · managed gate PASS · sample module build/vet/test/run green with the drift gate FRESH | reverse: the emitter may not re-add a pre-bump around emit_block_body calls (the contract is written at both sites); the build gofmt pass may not become load-bearing for CORRECTNESS (gofmt failure must never block a build)
2026-10-14 | Batch P: per-callee fast-path stack budgets (row 4, G2 follow-up #2) — three guard classes + the class ledger, and the classification CAUGHT a latent soundness gap — design: the fast path's guard proves headroom at ENTRY and nothing after, so a crossing may take a guarded fast path ONLY if the callee's worst-case stack use is an upper bound below the guard; classes = SMALL (1024, Cross1S..4S, new trampolines byte-identical in discipline to the defaults) / DEFAULT (4096, Cross1..4, UNTOUCHED so gates/G2.md evidence stays valid) / DEEP (CrossDeep1..4, the pooled 1 MiB stacks). The ledger (interfaces/descriptors.md) grounds every curated fn: sha3 ALL SMALL (fixed 200-byte permutation state, loop-bounded); serde_json SPLIT BY RECURSION — parse (remaining_depth=128; measured ceiling 127/128), get_array/array_get (clone), set (drop of the REPLACED value), release (drop), to_string_pretty (serialize) all walk the value tree → DEEP; the O(1) table/leaf ops → SMALL; regex DEFAULT (argued-bounded, unmeasured — honest). The classification exposed that the pre-row-4 json Parse rode the default 4096-guard fast path while a 127-deep parse needs an order of magnitude more — a latent stack overflow on shallow goroutines for deep inputs (the exact class of accepted-but-unsound the GUARANTEES.md protocol names; found internally, fixed before any external report, regression-pinned by TestDeepNestingParsesViaDeepPath + TestDeepNestingOnConstrainedStack with the new DeepCrossCount as oracle). Diagnostic parity: Cross2/3/4 count deep retries (were silent); DeepCrossCount added for the always-deep route. Evidence: overheadbench guard-class test pins the (1024,4096) disagreement window (SMALL fast + DEFAULT deep at the SAME headroom, DeepPathCount the oracle) + grown-stack SMALL loop frozen; jsonbinding deep-nesting tests; examples 10/10 (05 byte-exact through DEEP routes); corpus 20/20; differential 9/9+11/11; gofmt/vet clean. Row 6 rides the same batch: make bench on the Actions tier = 5.30 ns (MISS vs the 5 ns sandbox-tier budget, recorded honestly — three-tier hardware sensitivity now measured: 3.39 sandbox / 5.30 Actions / 6.93 worker) | reverse: reclassify any fn without a ledger row + measurement/argument = forbidden; the DEFAULT-class trampolines may never change (G2 evidence) — new eligibility comes from NEW classes only- 2026-10-14 | Batch N: Discussion #1's reply merged into the plan + install friction killed (the two trust blockers it named: evidence + install) — the first community review landed (ssmurfgg04-gif, 4 substantive asks). (1) EVIDENCE → GUARANTEES.md, the line-by-line claims table over exactly the primitives the reply listed (sync.Pool / atomic.Pointer / context.Context / finalizers / unsafe / cgo / channel-close races), every row citing its SPEC rule + corpus evidence, no claim stated where true, the §9.2 quote-shape paragraph as normative header, soundness-bug protocol pledged (P0 by definition, published severity+status, corpus regression before fix); README links it. (2) INSTALL → the reply's bar was "more than two commands or build Rust first = I'll wait" — v0.1.0's tarball shipped NO prebuilt staticlib (INSTALL.md told users to install Rust 1.99.0 — the exact pitch-death the reply predicted) → fixed: tools/package_release.sh (reproducible: crate-local hyrt build for the freshness-mtime contract, hyb release, tarball + sha256, smoke test from the ACTUAL tarball with cargo REMOVED from PATH — PASS, 'hello, Hybrid!' rustless) + prebuilt libhyrt.a now in the tarball (ensure_staticlib's freshness check reuses it; zero cargo needed) + install.sh (one command, resolves latest release via API, sha256-verified, extracts to ~/.hybrid, bakes a hyb launcher wiring HYB_RUNTIME_DIR, verifies via hyb explain E0002 — never --help, exit 2 by design) — end-to-end tested locally against the live release. (3) HATCH → --deny-managed landed in hyb check (any managed block fails the check by policy; JSON mode keeps stdout pure JSON with the notice on stderr; pairs with --report-managed; 4 integration tests over corpus 02/15 in hyb/tests/deny_managed.rs). (4) WORDING → README now leads Quick start with the one-command install + GUARANTEES link; new queue rows 11–15 (multi-platform matrix, Docker, sample-repo-vs-go.mod design, managed hardening phase 2, soundness ledger+bounty); the -race wording audit found no parity claims to fix (spike-4 'race-clean' = a test result, not parity) | discussion reply posted point-by-point with links; more questions posted (platform poll + go.mod integration design) | reverse: rows are plan-level; reversing = close with reasons in the Discussion thread, not silently
2026-10-11 | Pin go1.26.9 not 1.27.2 | patch-mature line; stability over freshness | reverse: change PINNED_GO + record
2026-10-11 | Makefile over justfile | zero install cost | reverse: add justfile if it pays
2026-10-11 | License dual MIT/Apache-2.0 | SPEC §12 default | reverse: user decision
2026-10-11 | No gh CLI; curl+REST | REST covers dispatch/polling | reverse: install gh if ergonomics demand
2026-10-11 | Build-vs-extend = B (provisional) | evidence above | reverse: at G0 with spikes 3–6 data; spike 1/2 artifacts are route-agnostic
2026-10-11 | Crossing = address-broker + trampoline (not cgo, not 2017-rustgo-trick) | cgo_import_static rejected by go1.26; measured 2.82 ns safe | reverse: if a Go release breaks asm assumptions, cgo fallback is the §5 row-3 path
2026-10-11 | Benchmark spread via count=10 + python stats (benchstat not installed; criterion skipped) | 2-core box | reverse: install benchstat on a worker and re-analyze
2026-10-11 | Commit spike work/ source (gitignore artifacts only) | workers must run spikes remotely | reverse: n/a
2026-10-12 | KAGGLE_API_TOKEN as GitHub Actions secret; kaggle.yml dispatch workflow | user request; one code path (tools/job.py) for all tiers | reverse: rotate token + delete secret
2026-10-12 | Runner env report redacts secret-looking values; CI scan extended to JWT shapes | R10: ephemeral Kaggle JWTs leaked into 2 committed summaries (redacted same day, tokens session-scoped/expired) | reverse: n/a
2026-10-12 | Spike 1 shared mmap stack RETIRED for concurrency; fast path on caller's goroutine stack + pooled deep stacks | real crash (cleanup goroutines) + measured 2.42 ns fast path | reverse: per-M stacks via TLS g if pooled deep path ever shows contention
2026-10-12 | Memory model = owning-side handle tables (gen-tagged ids) + copy-small/pin-large borrows | P3 pre-registered fallback fired (Pinner +55 ns > cgo); P1/P2/P4/P5/P6/P9 pass | reverse: revisit if Pinner gets cheaper in a future Go
2026-10-12 | runtime.g offsets (stackguard0) pinned + DWARF extractor + canary test | fast-path guard check needs one offset; version bump → re-run extractor | reverse: cgo fallback if a Go release breaks asm assumptions
2026-10-12 | Error ABI = two-word HyResult (RAX:RDX) + sentinel table + wrap-on-demand; panic = abort at Rust edge | Spike 5 all-green; +0.16 ns for (T, error) | reverse: catch_unwind-at-edge only if abort proves unacceptable at G1
2026-10-12 | Job commands never pipe into head/tail on live producers (SIGPIPE silently kills the suite; also masks exit codes) | job 003's first run died silently to a gofmt gate + masked pipeline | reverse: n/a — runner already truncates output itself
2026-10-12 | Scheduling = two-tier: syswin (entersyscallblock linkname, stdlib-legal) behind sampler-gated admission + concurrency-sized bounded pool overflow; M1 forbidden for blocking callees | Spike 4: M1 169× starvation; uncapped M2b crash at ~718 threads; M2b two-tier 1.0–1.1× M0; P-release canary syswin/floor=1.01 | reverse: if a Go release breaks the linkname pair, M3 pool is the full fallback (no runtime internals)
2026-10-12 | Blocking pools sized for CONCURRENCY (128/256), CPU pools stay GOMAXPROCS | GOMAXPROCS pool throttled overflow to 40–200 tasks/s; 128 lanes hit the predicted bound (4.01 s vs 3.9 s) | reverse: make it a descriptor tunable with measured defaults
2026-10-12 | Bridge owns hard thread budget via 50 ms sampler + admission gate (never per-call /proc) | crash finding (Go Ms never shrink + ~717-thread address-space wall); per-call /proc read cost ~1–2 ms under intercepted syscalls | reverse: n/a — the sampler IS the production shape
2026-10-12 | Spike 4 P-release canary: iteration-ratio → self-calibrating CPU-time/floor form | 2-busy-thread ceiling on this box is ~1.5× (environmental); null = 1.0; thresholds 0.80/0.75/1.25 vs in-process floor | reverse: n/a — measurement-theory correction, claim unchanged
2026-10-12 | Makefile recipe tabs fixed (committed spaces made every target unrunnable) | make check failed with 'missing separator'; earlier sessions had invoked run.sh directly | reverse: n/a
2026-10-12 | Session-3 sandbox-reset recovery: re-clone + re-pin toolchains + re-stage kaggle creds; secret verified intact server-side | sandbox was reset between sessions; all work was pushed | reverse: n/a
2026-10-12 | Blocking dispatch pair cost re-scored: ~0.9 ms intrinsic on both tiers (not syscall interception — worker refuted the sandbox theory); design-absorbed (blocking-only callees; amortized: load cells 1.0–1.2× M0 up to 100k) | honest ledger entry per SPEC §14.7 | reverse: revisit if a Go release makes exitsyscall fast-path viable for single callers
2026-10-12 | G0 gate PASSED; build-vs-extend re-run = Option B CONFIRMED (strengthened by spikes 3–6) | spike-report.md + gates/G0.md | reverse: never-cut fallbacks priced (cgo bridge / M3 pool)
2026-10-12 | HUMAN RULING Q1: Tier-0 sendability = strict (c)+(b), PROVISIONAL. Alternatives recorded with rejection reasons: (a) Go-compatible = no race-prevention claim = no reason to exist vs Go; (b) alone = partial claim, still permits shared-mutable aliasing at spawn; (c) alone = move semantics incomplete (sender could race on moved value's aliases). Binding additions: adversarial corpus written BEFORE the checker lands and treated as THE spec (selection bias in Spike 6's chosen-ten acknowledged); checker diagnostics must be diagnostic-not-punitive with fix-it suggestions (time budgeted); managed greppable + auditable + countable per project via --report-managed; tripwire = reopen G0 if >~25% of adversarial corpus needs managed OR same rejection repeatedly hit on idiomatic patterns; SPEC-LANGUAGE.md states race-freedom ONLY for the checked subset with the managed boundary in the same paragraph | human owner decision, QUESTIONS.md Q1 | reverse: tripwire or reviewer pressure → reopen G0 with the recorded alternatives
2026-10-12 | HUMAN RULING Q2 (reclassified design decision): bridge thread budget = configured ceiling + lower-only probes. Full binding design: (1) ceiling = configured value (max_threads), default min(512, 0.5 × pids.max) when rlimit/cgroup pids.max is readable (cheap + certain signal; deterministic; sampler never gates the ceiling); (2) INVARIANT: probes and rlimit may only LOWER the effective budget, never raise it above the configured ceiling — explicitly tested; (3) startup logs the effective budget + its source (configured / lowered-by-probe / lowered-by-rlimit) — mystery-stall insurance; (4) behavior AT the budget is specified (queue/backpressure, documented — a budget with unspecified limit behavior is a delayed crash); (5) docs note the ceiling is raisable on high-pid environments (Kaggle tier: pids.max 38508); (6) descriptor schema's two fields (configured ceiling, probed value) documented with min-semantics so nobody builds on spike behavior by accident | human-endorsed (b)-tightened; Q2 reclassified out of QUESTIONS.md per process note | reverse: change default formula + one config knob; spike code (probe-only) is throwaway and will NOT ship
2026-10-12 | Escalation bar tightened (human process note): QUESTIONS.md is for expensive-to-reverse items only (language-level promises, legal, credentials, destructive, budget); afternoon-reversible design choices go straight to this Decision Log | fewer, sharper escalations get faster answers | reverse: n/a
2026-10-12 | Competitive strategy adopted as roadmap input (human-supplied): match GALA/Lisette on type safety (table stakes — enums + exhaustiveness, null safety, sum types + pattern matching, Option/Result, immutability), beat them on Rust interop (the differentiator — "Keep Go exactly as it is. Add Rust where you need it"), never sacrifice Go compile speed or simplicity (what makes devs STAY). Copy DX wins: stable error codes (GALA-Exxxx shape), 500+ diagnostic coverage (Lisette), full DX suite + version manager (Soppo approach). Do NOT copy: monads/functional purity (GALA), Rust syntax (Lisette), "Go superset" positioning (Soppo — Hybrid is not a superset) | research/positioning.md + research/competitive-dx-study.md | reverse: re-run at G1 with MVP adoption data
2026-10-12 | Diagnostic code format = HYB-Exxxx (category digits: E0 parse / E1 resolve / E2 type / E3 own-sendability (E30xx send-move-freeze, E31xx loans) / E4 nil / E5 match / E6 bounds / E7 boundary / E8 lint warnings-only / E9 tool; append-only, never renumber, retired = permanent hole; one embedded reference page per code; hybrid explain; JSON envelope {"diagnostics":[…]} object-not-array at MVP-0; E3nnn rejections MUST carry fix-its) | lead decision during integration, grounded in GALA's 73-code registry + Lisette's 544-code taxonomy (dx study §6); spec + corpus rule-key updated in the same edit; initial 17 codes are the seed | reverse: re-map codes before first release (registry is append-only from the moment ANY external consumer exists; today only our own artifacts reference them)
2026-10-12 | Corpus programs 19 (freeze READ-form, CONTESTED — D1 flagged for G1 human pre-review) + 20 (freeze ALIAS-write, uncontested) added by the lead, still pre-checker: materialized 05's REQUIRED MUTANT + SPEC O5.2's pin; verdict distribution now ACCEPT 7 / ACCEPT-MANAGED 2 / REJECT 11; tripwire baseline recomputed: 10.0% verdict-level / 15.0% as-written (both < 25% → G0 stays closed) | OQ3 resolved by materialization | reverse: logged amendment only
2026-10-12 | Tier-1 amendment candidates recorded, NOT adopted (both would relax A1 strictness; both require logged amendments + human visibility): (i) lock-mediated sharing ("externally synchronized" clause — corpus 04/OQ2, the load-bearing tripwire case); (ii) GALA's field-access-sensitive capture analysis (immutable-projection reads pass at sendable boundaries — dx study copy-table #1; keeps strict ruling non-punitive) | strict Tier-0 verdicts stand until amendments land; this is the Q1 tripwire's working queue | reverse: logged amendment per corpus discipline
2026-10-12 | Post-MVP DX queue ORDERED (dx study §7, cheap-leverage first): llms.txt+errors-index → playground (Lisette WASM shape: client-side compile + play.golang.org execution, ZERO user-code execution on our infra — GALA's server-side playground is the named anti-pattern) → LSP (Soppo-scoped ~1.8k lines) → formatter (until then: gofmt-of-emitted-Go) → linter v0 → doctests (Soppo mechanism) → version manager (only after ≥2 released versions) → learn scaffold. MVP-0 adds NOW: JSON envelope + ~10 seed codes, version-pin enforcement in hybrid build (~30 lines), severity assert (lints-never-errors) | nothing promotes above the SPEC §7 MVP line | reverse: re-order at G1
2026-10-12 | Incremental-compile design hooks reserved at Phase-1/2 pipeline design (Lisette reference: deterministic FNV-1a keys, 3-tier invalidation, per-package dep-hash chaining, atomic writes) — "never sacrifice compile speed" is a strategic pillar, so package-source hashing shapes the pipeline even though the cache itself is post-MVP | dx study copy-table #10 | reverse: n/a (hooks are cheap)
2026-10-13 | Emitter file assembly is TWO-PASS: decls render into a body buffer while package roots collect in a BTreeSet; the header (package + imports, sorted) is written LAST — imports can never precede/follow decls incorrectly (recovered bug #1; struct-first files crashed go build in the dead session) | go build error 'expected declaration, found ident' at the crash point | reverse: single-pass only with pre-resolved import analysis
2026-10-13 | make()'s first argument renders as a BARE TYPE (recovered bug #2): the parser encodes type-as-value as an empty composite literal; emitting it as a value (chan job{}) is invalid Go | emitted 03 failed go build at the crash point | reverse: n/a — this IS the encoding's contract
2026-10-13 | E3 ?-desugar = unique hyErrN temps + explicit hyErr = hyErrN; return (wrapper closure shape per E6: (results…, hyErr error) so defers run LIFO BEFORE the stderr line; os.Exit skips defers, hence a wrapper, never a direct exit) | SPEC §6 E3/E6 + example 02's byte-exact exit contract | reverse: return-through-named-results only (fragile under shadowing)
2026-10-13 | String interpolation lowers to fmt.Sprintf with %v slots + %% escaping; all-literal interps stay plain strings (zero hidden allocation on the common path) | deterministic + matches Go idiom | reverse: string-concat lowering if benchmarks demand
2026-10-13 | M4 normalization scope: foreign package roots + Foreign-hinted bindings normalize; OUR struct fields/methods never do. Binding hints (Foreign via package-qualified define, Bytes via io.read_all) are the MVP-0 stand-in for the type layer | zero-annotation promise (our structs untouched) + example 02's byte path | reverse: real type checker supersedes hints (post-MVP)
2026-10-13 | AST contract extension (lead-owned, logged per interfaces/ discipline): ForKind::Range gains inclusive, Break/Continue gain label — '..=' and 'break loop' were documented contract gaps whose dropping was SILENTLY WRONG (example 04 would print 140, not 204; break-in-select would deadlock). Bare-ident labels stay unparsed: the lexer skips newlines, so break\nfoo() would misparse as a label | evidence-over-assertion: wrong output is worse than a parse error | reverse: real label grammar with newline awareness
2026-10-13 | break loop emits hyLoop: label + break hyLoop (loop is a Go keyword); label ownership = nearest enclosing loop, does not descend into nested loops | example 04's break-from-select | reverse: user-named labels with a real loop-label grammar
2026-10-13 | hyb build enforces toolchain pins at runtime (HYB-E9001; option_env! pins with sane defaults + HYB_ALLOW_TOOLCHAIN_DRIFT=1 escape); tools/check-versions.sh guards every version-bearing artifact and is negative-tested | DX study's version-manager pillar at ~30 lines; reproducible emitted-Go | reverse: drop the guard only with a logged decision (never silently)
2026-10-13 | Registry append +2: HYB-E0002 parse-error (the parser already emitted the code; it was registry-less), HYB-E9001 toolchain-mismatch | append-only discipline; 19 codes total | reverse: never (append-only)
2026-10-13 | G1 RATIFIED (human directive: "review gates/G1.md and ratify (or redirect) the lowering decisions"). Every lowering decision re-checked against its normative SPEC rule + implementation before ratifying: two-pass assembly (Go import order), interpolation→Sprintf (T4 %v-shape, all-literal fast path), E6 wrapper (§6.2 byte-for-byte — closure so defers LIFO precede the stderr line), E3 hyErrN desugar, task→go (C1), move-marker drop, M4 foreign-only normalization, binding hints as MVP-0 type table, O8 slot-loan copy+store-back (O9 honesty), hyLoop labels, option/set/pop prelude + assoc-fn mangling + generic shapes. NO redirects. Fresh-sandbox re-verification: 157 tests, corpus 20/20, tripwire not fired, 6/6 examples byte-exact. Batch order confirmed: Phase-2 bridge (05/09/10) → example 06 type knowledge → differential loop → overhead bench (G2 evidence) | gates/G1.md header records ratification + provenance | reverse: a ratified decision changes only via logged amendment (same discipline as checker verdicts)
2026-10-13 | Example 05 END-TO-END (Batch G): the serde_json handle bridge — jsonbinding Go package (generation-tagged handle Values, runtime.AddCleanup release, pinned-borrow key protocol, two-leg pretty-print buffer, Array() materializes a Go slice of handles); RUST_TYPES mapping (serde_json.value → jsonbinding.Value); Cross4 trampoline (handle returns need 4 words); E3b rule added to SPEC §6 (the ? expression form — hoist-to-binding before the statement: append(names, u.string("k")?), if u.int("k")? >= 3, for u in doc.array("a")?), hoists in evaluation order, never descending into fn-lit bodies; AST contract extension: CallArg.name (the parser previously DROPPED named args); sha3binding/jsonbinding import registration via is_package_root | 05 byte-exact vs expected.txt; 181 tests; 9/9 examples; corpus 20/20 | reverse: full handle-cleanup via AddCleanup is best-effort (Rust releases are idempotent + generation-checked); rustdoc-JSON descriptor automation is post-MVP
2026-10-13 | Example 09 END-TO-END (Batch H): package emission — the adoption story is a BUILD MODE — hyb build --package <name> --out-dir <dir> --binding-prefix <path> emits package <name> with pub-fn exports (M4 mapping: validate_email → ValidateEmail) + hybridge core + per-crate bindings + staticlib, importable by a plain Go module with NO Hybrid toolchain; AST contract ext: FnDecl.is_pub (pub was previously parsed-and-dropped); regex =1.11.1 pinned in hyrt (is_match status-in-RAX: 1/0/-1, is_valid bool); regexbinding package; E3 propagates through error-result fns (zero-results return) + return _, err zero-fill sugar (SPEC M2b + E3 notes); binding imports configurable by prefix (hybrid.program for programs, the consumer's path in package mode) | 09 byte-exact: ada@lovelace.dev <nil> / match: true from a plain go run of the committed main.go; 183 tests; 10/10 examples | reverse: multi-package Hybrid→Hybrid imports (M3's third form) stay post-MVP — one package per program build today
2026-10-13 | Batch I: the differential corpus loop is LIVE — and it caught seven real emission gaps — tools/differential_loop.py pins the pipeline side of the corpus contract (ACCEPT programs must build+run exit 0 through hyb; REJECT programs must be checker-rejected), wired into make test-quick/corpus + CI; fixes, each with a named regression test: (1) for _ in a..b emits a fresh hyBlank temp (Go has no blank := variable; for _ := … was invalid Go — corpus 16/17/18), for _ in ch → for range ch; (2) receiver typing for user-struct fields (var_struct + struct_fields maps): stats.mu.lock() → stats.mu.Lock() via the new sync.mutex/sync.rwmutex shape entries (corpus 18); (3) atomic.int64 = Go's atomic.Int64 STRUCT — shape-entry methods Add/Load/Store/Swap, value receivers auto-address (corpus 17); (4) the ? hoist is result-shape-aware: call_results() (rust-crate descriptors' new results field, METHOD_RESULTS table, user-fn declared shapes) — a 0-result call (doc.set(k,v)?) emits hyErrN := call with NO value temp and the statement skips its re-emit (corpus 12/13); (5) jsonbinding.Set takes any — scalars box through a JSON Marshal/Parse round-trip inside the binding (zero bridge changes), Set now surfaces the Rust status as error (corpus 12/13); (6) short return v in an error-result fn fills remaining slots with zero texts (return v, nil) — the EMPTY slot is the error result (corpus 13); (7) composite consts (slices/maps/structs) lower to var — Go's const admits only bool/string/number (corpus 17/18); (8) type-elided struct literals inherit the context type (emit_expr_exp: map VALUE / slice ELEM) — Go's own composite sugar (corpus 09); (9) an addressable argument auto-addresses at a pointer param (scale_then_register(e,…) with e *env — Go's method-receiver precedent, PINNED BY THE PRE-REGISTERED CORPUS, corpus 09); (10) a user fn whose declared result is a known handle type registers ForeignTy (s := summary(doc)? → s.Set(...) normalizes, corpus 13); (11) the duplicate hyErr = t propagation assign removed (manual push doubled propagate_error's branch) | differential 9/9 accept-side + 11/11 reject-side FULL AGREEMENT; 194 tests (11 new); 10/10 examples; corpus verdicts 20/20; tripwire not fired | reverse: the auto-address convention is a LANGUAGE decision pinned by the corpus — changing it needs a corpus amendment (never silently); MethodFunc was added then removed (dead) per the table's own discipline — atomic.int64 is a struct-method surface, not package functions
2026-10-14 | Release v0.1.0 shipped + community opened + fleet re-armed (customer-feedback batch, rows 8-10 + 2-3) — the two biggest customer concerns addressed the same day: (1) "no release yet" → v0.1.0 tagged and published with the prebuilt linux-amd64 tarball (hyb + runtime/ + INSTALL.md; the packaged layout smoke-tested end-to-end — extract, build a .hy program, run — BEFORE upload); release notes carry the sharp fail-closed contract AND the not-yet-guaranteed list (honesty preserved outside the repo too); (2) community → Discussions enabled (six standard categories) + feedback thread #1 in Q&A framed as four answerable problems (safety evidence, release bar, adoption model, hatch ergonomics) with labels, a kind star/contribute ask, and the good-advice-gets-merged pledge; repo description + topics set (discoverability). README rewritten to lead with the adoption model the feedback identified as the product's strongest part. Fleet re-armed with the Kaggle token: job 006-sanitizers-fuzzing (ASan leg over the bridge via go test -asan — ASan's malloc interception instruments the Rust staticlib's heap ops at link time, the honest stable-toolchain equivalent; -race leg over all five runtime packages; fuzz leg tools/fuzz/hyfuzz.py pinning the crash-class invariants: no hang / no crash / no ICE across token salad + corpus mutations + nest bombs, deterministic seed — coverage-guided cargo-fuzz needs nightly, documented cut) dispatched on 2 Actions shards; job 007-worker-tier-bench (G2 bench re-measured on the Kaggle tier, prior 4.12 ns spike-1, pre-registered ≤5 ns budget on the grown-stack fast path) dispatched via kaggle.yml. Off-topic template workflows removed (amazon-filter, price-fetch). Local validation before dispatch: -asan 4/4, -race 5/5, fuzz 300/300 invariants held, bench PASS 3.39 ns | rows 8/9/10 closed; rows 2/3 in flight on the fleet | reverse: n/a
2026-10-14 | Batch M: the safety checker is FAIL-CLOSED at critical boundaries (O4.9 rule FC) + closure-boundary checking (O4.10) — the customer-feedback directive landed — human ruling: "an unknown type or unsupported operation affecting ownership or cross-task sharing cannot silently pass as safe; the developer needs an explicit, auditable escape hatch; diagnostics clearly explain how to fix the problem". model.rs: TypeShape::Unknown removed from is_sendable_by_type (was implicitly permissive), Closure shape added (fn-typed values unsendable, A5); sendability.rs: new Outcome::Unproven classifies unresolvable names/bindings/pointees/expression results; check_site emits HYB-E3005 (registry entry with a 3-fixit menu, tier0_rule FC) outside managed, or the E8001 lint inside it (counted by --report-managed); closures.rs (new pass): boundary STATEMENTS inside fn() bodies are checked with the closure's ascribed params + the enclosing env as capture view — Finding 2 closed without touching the A5 capture perimeter (corpus 10's pre-registered ACCEPT preserved, OQ1 unchanged); lib.rs/loans.rs: select-recv defines use the channel's ELEMENT shape (ok is a bool) instead of manufacturing Unknowns; local ascriptions fill inference GAPS (an unresolvable initializer + var x T classifies as T; a resolved inference keeps priority so boundary-handle loan windows stay precise; a lying ascription dies at Go's build); parser.rs: the new test battery exposed TWO compiler hangs — a malformed select arm (case x:) spun the arm loop forever and a brace mis-nest spun the top-level decl loop forever (both: sync returning without progress) — fixed with a force-progress invariant in sync_stmt (stmt-starter arm) + sync_decl (both arms); } at depth 0 stays no-consume in sync_stmt so x := } still recovers with ONE diagnostic. Honest cost accepted by the directive: more programs are rejected — each rejection names the value, the reason, and the fix. Verification: cargo test --workspace 206/0 (was 194; +10 fail-closed checker tests, +2 parser no-hang regression tests) · corpus 20/20 (no pre-registered verdict flipped) · differential 9/9+11/11 FULL AGREEMENT · examples 10/10 · go vet+build+test 5 pkgs ok · clippy 0 findings · cargo fmt clean | SPEC-LANGUAGE §9.3 O4.9/O4.10 written; post-MVP rows 7–10 opened (release, community, marketing) | reverse: fail-closed→permissive would void §9.2 — the strictness can only be REFINED (e.g. new descriptor stubs resolving more shapes), never reverted, without a new human review
2026-10-13 | G2/G3 REVIEWED + RATIFIED — the MVP is DONE (human delegated: "review gates/G2.md and gates/G3.md — on approval the MVP may be called done then continue with rest of pending matters and through tests that you didnt cherry pick or device yourself just normal go and rust things"). Every G3 claim re-verified in a fresh sandbox with fresh toolchain installs via the STANDARD suites, not only the repo's harnesses: cargo test --workspace 194/0 (11 suites, default filter); make examples 10/10; make differential 9/9+11/11; corpus 20/20 (tripwire quiet); make bench fast path 3.44 ns ≤ 5 ns (69%; gate's 3.37 reproduced within variance; DeepPathCount path-proof reproduced); go vet + go build clean on all five runtime packages assembled in the exact hyb workspace shape. Four findings, all repaired + re-verified: (1) make bench claimed by Batch J never landed (b34d157 touched no Makefile) — wired, G2 evidence re-run through it; (2) the Makefile recipes lost their tabs at Batch I's regeneration (dae5014 reintroduced exactly what 8639e0b fixed) — EVERY make target was broken while CI stayed green because CI never invokes make; repaired + make -n syntax guard in make check + a CI Makefile-parse step; (3) 5/9 runtime Go files were not gofmt-clean — gofmt -w, vet/build re-run, 10/10 acceptance re-run after, gofmt+vet+build now a CI leg; (4) hyrt: unused Number import removed, documented crate-level allow for the C-ABI pointer-deref lint (18 exports; abi-types §5's protocol is the real contract), cargo fmt. Logged, not repaired (post-MVP queue row 1): compiler-workspace clippy = 33 style-level findings, zero correctness lints — churn at gate exit rejected. G3's honest not-claimed list reviewed and accepted as accurate; its fleet items are post-MVP rows 2–3 | gates/G2.md + gates/G3.md headers record the review; PLAN gate row updated; STATUS rewritten | reverse: gate verdicts change only via a new review with the same evidence discipline
2026-10-13 | Batch J: the call-overhead bench ON THE LIVE BRIDGE — G2 PASSED — hyb bench-overhead assembles the bench through the exact hyb build workspace recipe and measures a no-op crossing (Cross1 → hyrt's hy_nop) with path-proof instrumentation: hybridge.DeepPathCount (cold-path atomic — the fast path pays nothing) + Cross1Raw (the diagnostic no-retry trampoline); two scenarios because the in-trampoline guard requires 4096 B headroom and a FRESH main-goroutine stack holds only ~2.9 KB (probe: SP − g.stackguard0, offset 16 verified against go1.26.9 DWARF): shallow → deep path 19.19 ns (15,100,002 deep crossings counted); grown stack → fast path 3.37 ns ≤ 5 ns budget (67%), raw trampoline 2.65 ns ≈ spike-1's 2.82 ns prototype (design transferred intact), marginal delta over an equal Go call 1.25 ns; context: jsonbinding.NewObject (real call, Rust-side handle alloc) 806 ns | gates/G2.md PASSED 2026-10-13; make bench wired (not in CI's default path — ~40 s); 194 tests; 10/10 examples after the hybridge instrumentation | reverse: the pool stays (spike-3's TestConcurrentCrossing collision finding) — the ~16 ns deep-path premium over the spike's fixed-stack prototype is the recorded price of collision safety; per-callee budgets are the logged Cut-Log follow-up
2026-10-13 | Post-MVP row 1: style sweep — clippy CLEAN workspace-wide — cargo clippy --fix applied the machine-applicable subset (33→21), the rest by hand: 15× doc_overindented_list_items dedented via a script that drives cargo clippy --message-format=json and applies clippy's own suggested spans/replacements (scripts/fix_doc_overindent.py — clippy's help text is authoritative, never hand-guessed alignment); 2× needless_loop→while-let (lexer::lex, parser::parse_binary — semantics identical: condition re-evaluated per iteration in both forms); parser's to_place(&mut self,…) renamed place_of (clippy: to_* implies non-mutating; private, 6 sites in-file); hy-emit's fn_shapes row type factored into type FnShape = (usize, bool, Option<BindingKind>, Vec<Option<String>>) (clippy type_complexity — the four-tuple IS a concept, it now has a name); callee field-init shorthand; is_reference_alias→matches!. cargo fmt normalized all crates (hyrt already was). Re-verification: clippy 0 findings · cargo test 194/0 · differential 9/9+11/11 · corpus 20/20 (tripwire quiet) · examples 10/10 | post-MVP queue row 1 closed; row 2 (fleet sanitizers/fuzzing) next | reverse: n/a (style-only; no ABI, no lowering, no rule changes — full suite proves it)
2026-10-13 | Post-MVP row 5 (Batch L): package-level Go tests — the runtime's go test ./... now runs 20 tests, not "no test files" — written against the REAL hyrt staticlib (every test crosses the boundary): overheadbench pins the G2 path-proof as a regression (grown-stack → DeepPathCount frozen across 10k crossings) + payload fidelity across the values the bindings pass + 8×500 concurrent crossings (spike-3's collision-safety property); hybridge pins SPHeadroom>0 + the needsDeep/fastStackNeed constants; jsonbinding pins the WHOLE handle protocol (parse round-trip incl. serde_json's sorted-key pretty form, scalar boxing through Set, MOVE-SEMANTICS zeroing → reuse errors, the (0,0) empty-key borrow edge, type-strict getters, array materialization, push_string); regexbinding pins the Batch-H raw-\s lesson + IsValid + invalid-pattern-errors; sha3binding pins the NIST SHA3-256 vectors (""/"abc") + checksum determinism/seed/iters sensitivity. CI's Go-hygiene leg now runs go test after vet/build. Stale-archive trap found + documented: a manual cargo build --release inside runtime/rust/hyrt WITH env.sh sourced writes to the SHARED CARGO_TARGET_DIR (/home/z/go-hybrid-target) while an OLD pre-Batch-J archive sits at the crate-local target/ — hyb's own mtime freshness check is immune (it stats the crate dir and rebuilds into the workspace); the CI leg is immune (no env.sh); scripts must either unset CARGO_TARGET_DIR or copy from the shared dir. 20/20 go tests · examples 10/10 · corpus 20/20 · differential FULL AGREEMENT · cargo 194/0 after landing | post-MVP row 5 closed | reverse: the tests cross into the pinned staticlib — a hyrt behavior change that breaks them is a REAL regression, fix the runtime not the test (unless the contract itself changed via Decision Log)

Contributor validation — workload generation check (2026-10-15)

Baseline c09e992: benchmarks/workloads/shape.py --check overwrites rust/Cargo.toml, hiding manifest drift and rewriting even matching output. Include the manifest in the same generated-output inventory as the four programs; check all outputs without writing and report missing files as drift.
Six offline CLI regressions: baseline 1 passed / 5 failed; patched 6/6 passed. Fixtures compare content hashes, mtimes, and modes before/after check mode; generation still restores all five outputs. The actual workload check and git diff --check pass.
Full pinned Go/Rust suites were not run: those toolchains are unavailable locally. This base also has pre-existing CI YAML and Makefile indentation defects tracked by PRs #172/#199; their fixes and upstream CI are still needed. No compiler or runtime behavior is changed or claimed.

Cut Log

2026-10-13 | Per-callee fast-path stack budgets (widening fast-path eligibility below the 4096 B guard for tiny bounded callees on shallow stacks) | would shave the shallow-goroutine deep-path cost (~19 ns) for small callees | revisit if a workload shows steady-state shallow-stack crossings dominating; needs a descriptor + generator change + Decision Log entry (gates/G2.md follow-up #2)

Dependencies Added

(Batch J added none: hy_nop is hyrt-internal; overheadbench/hybridge diagnostics are repo packages)
kaggle CLI 2.2.4 (pypi, /home/z/.venv) — worker tier protocol — Apache-2.0 (kaggle-api)
(no cargo crates in the project yet; spike crates rustrt/rustbench are dependency-free stdlib-only)

Contributor validation plan (2026-10-14)

hyb generate package inference: reproduce on 8aaa231 with app.go (package demo), app_test.go (package demo_test), and calc.hy. Expect generation and freshness checks to succeed, then ordinary go test to run the generated function. Negative controls: test-only siblings must not choose a production package; conflicting non-test packages must still reject without emitting. Run the regression tests against the original source before patching, then the compiler workspace, corpus, and differential loop with pinned Rust 1.99.0 / Go 1.26.9.
Result: original 8aaa231 fails 2/3 new regression tests; patched source passes 3/3, including ordinary Go tests of the generated exported function. Rust 1.99.0 / Go 1.26.9 on macOS arm64: compiler workspace 258/258, checker corpus 25/25. Differential loop 8/10 accept, 15/15 reject on BOTH original and patched source: cases 12/13 fail the existing Mach-O staticlib detection. Upstream Linux CI remains required before final review.

Contributor validation plan (2026-10-15)

Installer upgrade preservation, baseline f99d6d0: use checksummed offline release fixtures and temporary install/bin directories. A release missing its CLI, missing its runtime, or containing a CLI that fails explain E0002 must fail before changing an existing installation. Compare all installed bytes and verify the previous launcher still runs. Control: a healthy replacement must upgrade successfully. Run these regressions before and after the fix, existing installer tests, Python tooling tests, and shell syntax checks. This is installer correctness, not a compiler soundness claim. Go/Rust are unavailable locally; upstream compiler CI remains required.
Result: baseline fails all three invalid-upgrade subcases; healthy-upgrade control passes. Candidate validation before deletion makes both tests pass (all three invalid cases preserve installed bytes/modes and the running old launcher). Existing installer tests 8/8, Python tooling tests 19/19, sh -n install.sh, and git diff --check pass. No toolchains were downloaded and no compiler/runtime behavior is claimed. CI now runs the upgrade regression alongside the existing offline installer test. This prevents invalid-payload replacement; it is not a rollback mechanism for later disk/copy failures.

External contribution candidate — 2026-10-14 (pending owner review)

select default arms were unreachable: the parser expected a keyword the lexer never emits. Recognize default contextually only before :/=>, including unbraced-arm lookahead; retain ordinary identifier/channel uses. Six AST regressions cover braced/unbraced/default-first forms, identifier compatibility, and missing separators. Original parser: four new failures and two control passes.
Add corpus 25–28: mutable-map select-send rejection (A1c/E3002), safe string/channel sends, unresolved-name rejection (FC/E3005), and a nonblocking default fallback. Preserve all 24 upstream verdicts. Renumber our four additions after integrating main 2e79213, since upstream cases21–24 landed during submission. The first submitted 2866a12-based candidate had236 passing Rust tests and24/24 corpus; these are historical results, not the updated inventory.
Combined candidate on main2e79213: Rust1.99.0 workspace244/0, clippy clean with warnings denied, corpus renumbered to this integration's 32-35 slots (10ACCEPT/2ACCEPT-MANAGED/16REJECT at submission; now part of the 35-file corpus), six Python CLI regressions; strict parser inventory28 and CI/Makefile counts updated. Optional exact first-error codes E3002/E3005 pass. New accepted26/28 build/run with pinned Go1.26.9 Darwin/arm64. Full local differential:9/12 accepted and16/16 rejects; unchanged12/13 cannot link Darwin bridge staticlibs and unchanged02 hits its documented concurrent-map runtime hazard. Owner Linux CI still requires maintainer approval; no award/payment implied.

Scoped contributor validation: Kaggle payload quoting (2026-10-15)

A valid triple-quoted command breaks generated worker Python on main c09e992. Embed JSON with repr(payload); four offline upload-boundary tests verify source parsing, exact payload fidelity and cleanup. Baseline: 2 pass/2 SyntaxErrors; patched: 4/4 on Windows, all 66 tooling tests on Ubuntu in a normal LF checkout. No live Kaggle push, Rust/Go suite or upstream CI claimed; maintainer review pending.

Contributor validation: managed report shape (2026-10-15)

Base c09e992: a checker exiting 0 with {} is treated as a successful empty audit; --rebaseline can erase a previously reviewed inventory. Require an object report, a nonnegative integer managed_blocks count, a list when blocks is present, matching count, and valid block categories. Preserve Rust's omitted-empty-blocks encoding. This is tooling robustness against malformed checker output, not a demonstrated compiler soundness vulnerability.
Before fix: 26 failing and 14 erroring subcases in the new malformed-report test; valid empty-report control and 11 existing tests pass. After fix: all 13 managed-gate tests pass, including 40 malformed report/mode combinations. A separate real-subprocess stub returning {} reproduces original PASS/baseline erasure and patched exit 2/byte preservation. Existing report fixtures now include the counter emitted by the Rust serializer. git diff --check passes. Rust/Go suites were not run locally (pinned toolchains unavailable); upstream CI remains required. Main's existing ci.yml line 35 indentation failure is covered by #172/#199 and outside this change.

Contributor validation: submit revision lookup (2026-10-16)

Base 00610f7: resolve_head ignores failed git rev-parse, allowing an invalid revision/error message into a Kaggle upload and submitted.json. Abort before touching worker files or invoking Kaggle when HEAD lookup fails.
Three new offline tests: original two failures/one pass; patched all 11 job-test methods pass. Real temporary Git repositories cover unborn and committed HEAD; a mocked upload boundary verifies no push, payload mutation or submission record after lookup failure. git diff --check passes. No real Kaggle submission or compiler/Rust/Go suite run; maintainer CI remains required, including repair of existing workflow conflict markers (#339).

Navigation Menu

Repository navigation

PLAN.md

PLAN.md

Hybrid Language: Development Plan

Contributor validation — 2026-10-15

Status

Environment

Design Decisions in Force

Claims Verification

Spike Results

Task List

Blockers

Risk Register

Review Gates

Test Results

Post-MVP queue (reopened 2026-10-13 at the G3 review — work in priority order; each row lands with its own commit + Decision Log entry)

Decision Log

Contributor validation — workload generation check (2026-10-15)

Cut Log

Dependencies Added

Contributor validation plan (2026-10-14)

Contributor validation plan (2026-10-15)

External contribution candidate — 2026-10-14 (pending owner review)

Scoped contributor validation: Kaggle payload quoting (2026-10-15)

Contributor validation: managed report shape (2026-10-15)

Contributor validation: submit revision lookup (2026-10-16)

FilesExpand file tree

PLAN.md

Latest commit

History

PLAN.md

File metadata and controls

Hybrid Language: Development Plan

Contributor validation — 2026-10-15

Status

Environment

Design Decisions in Force

Claims Verification

Spike Results

Task List

Blockers

Risk Register

Review Gates

Test Results

Post-MVP queue (reopened 2026-10-13 at the G3 review — work in priority order; each row lands with its own commit + Decision Log entry)

Decision Log

Contributor validation — workload generation check (2026-10-15)

Cut Log

Dependencies Added

Contributor validation plan (2026-10-14)

Contributor validation plan (2026-10-15)

External contribution candidate — 2026-10-14 (pending owner review)

Scoped contributor validation: Kaggle payload quoting (2026-10-15)

Contributor validation: managed report shape (2026-10-15)

Contributor validation: submit revision lookup (2026-10-16)