Hyperlang 0.1.0

First public release.

Public API

The door:

• Hyperlang.program/1: compile an immutable source value into a
  %Hyperlang.Program{}.
• Hyperlang.program/2: return a program cached under a caller-owned key and
  call the loader only on a miss.
• Hyperlang.run/4: run one declared export with the authority in a spec.
  Success is {:ok, value, %{stdout: [binary], reductions: integer, wall_us: integer}}; failure is {:error, sanitized_error} with a category
  from the closed fault taxonomy.
• Hyperlang.module/1: return the confined OTP callback module of a program.

Host contracts and tools:

• Hyperlang.Program: the opaque, content-addressed program struct.
• Hyperlang.Binding: behaviour for host capabilities (exports/0,
  call/3). Export options are limits, nondeterministic, effects and
  docs.
• Hyperlang.SyscallHost: behaviour for the spec.syscall door behind the
  guest sys:* facade (syscall/3, optional opaque_spawn_args?/1), plus
  normalize/2, get_state/0 and put_state/1.
• Hyperlang.Scope: host-selected resource scopes (configure/2,
  with_scope/2, current/0, close/1, stats/1). A scope bounds
  concurrent runs and compiles, queues admission, sets the priority class,
  caps aggregate heap, and charges channels, buffers and timers.
• Hyperlang.Limits: process-group reduction, ceiling and wall-deadline
  metering for host spawn hooks (group/1, limit/2, attach/3,
  detach/2, detach_children/1, delete/1, stat/1).
• Hyperlang.Chan: typed channels for syscall hosts.
• Hyperlang.Check: static whole-image checking of multi-module guests.
• Hyperlang.Manpage: troff man(2) pages for allowlisted stdlib modules.
• Hyperlang.Test: test kit (program/2, program!/2, run/4, run!/4,
  start_actor!/3, assert_stdout/2).

Manifest keys (atoms only; unknown keys are rejected): entry, result,
exports, bindings, limits, terms, stdlib, syntax,
capabilities, profile, code_pool, sys, modules, filesystem,
tables and atom_universe.

Run spec keys: bindings, policy and syscall. Policy covers
max_reductions/budget, heap_words, wall_ms, atoms, scope, and
actor-lifetime rate and ceiling.

Other modules are internal and are not covered by version guarantees.

Isolation guarantees

• Each run gets fresh reduction accounting, and run-owned guest children
  are killed when it ends. A spawned run's limits group is destroyed with
  the run; the in-caller runs of one process (all callbacks of one actor)
  share one group whose usage restarts with every run.
• Wall deadlines use a per-run timer, not a polling tick.
• Timer quotas and handles are keyed by host scope. Handles are random
  128-bit integers, and cross-scope read or cancel returns false.
• Channels, buffers and broker heaps are charged against scope quotas and a
  live owner.
• A live OTP actor pins its program's code slot until it exits, so its
  callback module never unloads under it. Pins are charged to the actor's
  scope and bounded by the scope policy max_code_pins.
• OTP actor status and crash reports always go through the host redactor.
• Guest mailboxes are on-heap.
• Internal fun application checks fun provenance.