Hyperlang 0.2.0

Public API

• Breaking: Hyperlang.module(program) is removed. It returned a code-slot
  module name that was not pinned until an actor's init/1 ran. A release
  or reclamation in between made the start fail with undef, or made the
  actor run another program that had reused the slot.
• Hyperlang.Actor is the public GenServer callback module for program
  actors. Its init argument is {spec, program, arg}, and child_spec/1
  takes the same tuple (id Hyperlang.Actor, restart :permanent; give
  each of several actors under one supervisor its own id with
  Supervisor.child_spec/2). The actor's init/1 loads the program and
  pins its slot in one step, so the actor always runs exactly that program.
  Bad init arguments stop it with {:hyperlang, %{category: :api}}.
• Migration:
  GenServer.start(Hyperlang.module(program), {spec, arg}) becomes
  GenServer.start(Hyperlang.Actor, {spec, program, arg}), and
  GenServer.start_link likewise.
• Hyperlang.load/1 loads a program ahead of its first use and returns
  :ok or {:error, sanitized_error}. Migration: a preloading
  Hyperlang.module(program) call becomes :ok = Hyperlang.load(program).

Behaviour

• Generated modules no longer export OTP callbacks; GenServer.start/2 on
  one fails with undef. An actor's process module is Hyperlang.Actor.
• An actor calls handle_info/2 and terminate/2 only when the program
  exports them. A message to a program without handle_info/2 is dropped
  without a log entry. A missing handle_cast/2, handle_call/3 or
  handle_continue/2 stops the actor with the typed run/4 error
  (category: :export) instead of undef.
• An actor's init/1 no longer stops with code_pool not_loaded. It stops with
  code_pool when the program's window has no free slot, or with
  pin_limit at the scope bound (checked before any load).
• The compile for a load done by init/1 is charged to the actor's scope.

Isolation verification

• Heap pressure has a tested bound: with 16 heap-pressure tenants in
  :background scopes with a churn quota, the latency-class victim's p99
  stays within 3x its unloaded p99. The R2-4 paired measurement now spreads
  loaded blocks over a whole quota refill period, so rate-limited bursts are
  measured.
• Corrected noisy-neighbour figures. The sequential matrix and the comparison
  bench sampled the victim only before the first quota refill, so they never
  saw the noisy tenants' refill bursts. Requests are now spread evenly over
  four refill periods. With 16 tenants in background scopes the victim's p99
  slowdown is 1.7x (CPU), 2.1x (heap) and 1.9x (compile), and the comparison
  figure is 1.65x; 0.1.0 published 1.1x, 1.1x, 1.0x and 1.37x.

Package

• The Hex package links to this changelog.

Hyperlang 0.1.0

First public release.

Public API

The door:

• Hyperlang.program/1: compile an immutable source value into a
  %Hyperlang.Program{}.
• Hyperlang.program/2: return a program cached under a caller-owned key and
  call the loader only on a miss.
• Hyperlang.run/4: run one declared export with the authority in a spec.
  Success is {:ok, value, %{stdout: [binary], reductions: integer, wall_us: integer}}; failure is {:error, sanitized_error} with a category
  from the closed fault taxonomy.
• Hyperlang.module/1: return the confined OTP callback module of a program.

Host contracts and tools:

• Hyperlang.Program: the opaque, content-addressed program struct.
• Hyperlang.Binding: behaviour for host capabilities (exports/0,
  call/3). Export options are limits, nondeterministic, effects and
  docs.
• Hyperlang.SyscallHost: behaviour for the spec.syscall door behind the
  guest sys:* facade (syscall/3, optional opaque_spawn_args?/1), plus
  normalize/2, get_state/0 and put_state/1.
• Hyperlang.Scope: host-selected resource scopes (configure/2,
  with_scope/2, current/0, close/1, stats/1). A scope bounds
  concurrent runs and compiles, queues admission, sets the priority class,
  caps aggregate heap, and charges channels, buffers and timers.
• Hyperlang.Limits: process-group reduction, ceiling and wall-deadline
  metering for host spawn hooks (group/1, limit/2, attach/3,
  detach/2, detach_children/1, delete/1, stat/1).
• Hyperlang.Chan: typed channels for syscall hosts.
• Hyperlang.Check: static whole-image checking of multi-module guests.
• Hyperlang.Manpage: troff man(2) pages for allowlisted stdlib modules.
• Hyperlang.Test: test kit (program/2, program!/2, run/4, run!/4,
  start_actor!/3, assert_stdout/2).

Manifest keys (atoms only; unknown keys are rejected): entry, result,
exports, bindings, limits, terms, stdlib, syntax,
capabilities, profile, code_pool, sys, modules, filesystem,
tables and atom_universe.

Run spec keys: bindings, policy and syscall. Policy covers
max_reductions/budget, heap_words, wall_ms, atoms, scope, and
actor-lifetime rate and ceiling.

Other modules are internal and are not covered by version guarantees.

Isolation guarantees

• Each run gets fresh reduction accounting, and run-owned guest children
  are killed when it ends. A spawned run's limits group is destroyed with
  the run; the in-caller runs of one process (all callbacks of one actor)
  share one group whose usage restarts with every run.
• Wall deadlines use a per-run timer, not a polling tick.
• Timer quotas and handles are keyed by host scope. Handles are random
  128-bit integers, and cross-scope read or cancel returns false.
• Channels, buffers and broker heaps are charged against scope quotas and a
  live owner.
• A live OTP actor pins its program's code slot until it exits, so its
  callback module never unloads under it. Pins are charged to the actor's
  scope and bounded by the scope policy max_code_pins.
• OTP actor status and crash reports always go through the host redactor.
• Guest mailboxes are on-heap.
• Internal fun application checks fun provenance.