refactor: move file I/O from core to system (capability model)#130
Merged
Conversation
slurp, spit, load-file and load-file-once move from core to the system library. core becomes a pure base with no ambient filesystem access: it keeps eval/read-program/read-string (evaluate code held as data) but can no longer read a file to run it. File access is an explicit capability — +system for raw I/O, +require for structured module loading (require reads modules itself in Go, so it needs neither slurp nor system). - Move slurp/slurp_source/spit + the VerifySource integrity hook from lib/core to lib/system; move the load-file header (header-load-file.lisp) and load-file-once from nscore.LoadInput to nssystem.Load. read-program and eval stay in core. - command's setupIntegrity now installs system.VerifySource. - Not user-facing: the lisp binary loads system by default, so scripts and CLI script execution (which uses load-file) are unaffected. Breaking for embedders loading only core — they must add nssystem.Load (after core + its input layer). Documented in the CHANGELOG. - Updated the ~15 test harnesses that build core-only envs and use slurp/load-file to also load system/nssystem; docgen blurbs and LANGUAGE.md regenerated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
fullEnv REPLed the load-file header but didn't register slurp-source (which moved to system), so load-file failed and the DAP server hung waiting for a stopped event that never came — a 10m timeout under -tags debugger ./... on CI. Add system.Load(ns). Verified the full tagged suite passes with no hang. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves
slurp,spit,load-fileandload-file-oncefromcoreto thesystemlibrary, makingcorea pure base with no ambient filesystem access.corekeepseval/read-program/read-string— it can evaluate code you hold as data — but can no longer read a file to run it. File access becomes an explicit capability:+system(nssystem.Load) — raw host I/O:slurp/spit,load-file/load-file-once, pluschdir/cwd/mkdtemp/remove-alland the env-var builtins.+require— structured module loading;requirereads modules itself (in Go), so it works withoutsystemorslurp.A coherent three-tier capability model, aligned with the integrity work.
What moved
slurp/slurp_source/spit+ theVerifySourceintegrity hook:lib/core→lib/system.load-fileheader (header-load-file.lisp) +load-file-once:nscore.LoadInput→nssystem.Load.read-programandevalstay in core.command'ssetupIntegritynow installssystem.VerifySource.Compatibility
lispbinary loadssystemby default, so scripts usingslurp/spit/load-fileare unaffected, as is running a script (the CLI does that viaload-file).core/nscoreand used those builtins: they must now alsonssystem.Load(after core and its input layer —load-filebuilds onslurp-sourcefrom system plusread-program/evalfrom core). Documented as aTest plan
slurp/load-fileto also loadsystem/nssystem.-tags debugger(the tag activatesslurp'slispruntimemodule-registration path).load-filepath) andspit+slurpround-trip both work.core.LoadInputnow registers only stdin/exit; a core-only env has noslurp/load-file(capability model holds by construction).docgenblurbs +LANGUAGE.mdregenerated.🤖 Generated with Claude Code