Claude/thalyx programmable transaction hrexv1

Cargo.toml

@@ -16,6 +16,7 @@ members = [
     "crates/thalyx-graph",
     "crates/thalyx-know",
     "crates/thalyx-rust",
+    "crates/thalyx-program",
     "crates/thalyx-memory",
     "crates/thalyx-watch",
     "crates/thalyx-journal",
@@ -61,6 +62,7 @@ thalyx-install = { path = "crates/thalyx-install" }
 thalyx-graph = { path = "crates/thalyx-graph" }
 thalyx-know = { path = "crates/thalyx-know" }
 thalyx-rust = { path = "crates/thalyx-rust" }
+thalyx-program = { path = "crates/thalyx-program" }
 thalyx-memory = { path = "crates/thalyx-memory" }
 thalyx-watch = { path = "crates/thalyx-watch" }
 thalyx-journal = { path = "crates/thalyx-journal" }

README.md

@@ -255,11 +255,32 @@ first one found out and a stale answer says it is stale.
 
 The whole of that is one call: resolve the symbol, rewrite every real use, see
 what changed, work out what to compile, reuse what still holds, compile the rest,
-commit or put the tree back — with no model inference in between. What is proven
-in a container is stage 57 of `verify.sh`; the vertical over a real Btrfs
-subvolume with the compiler running confined is stage 58, and whether any of it
-makes a frontier agent do more correct work with less effort is **not measured**.
-It is built to be measured next; no benchmark was run.
+commit or put the tree back — with no model inference in between.
+
+**And the operations no longer have to be known in advance.** `hacer` takes a
+short JavaScript program, run inside the same reversible boundary by a QuickJS
+compiled into the binary: variables, loops, conditions, assertions, and calls to
+the machine whose answers the next line reads. So a request can list a directory
+nobody has described, loop over what came back, read each file, change only the
+ones whose contents say to, watch what the tree really shows, validate, and
+branch on the verdict — none of which is writable in advance, because writing it
+would mean already having the answer. The program is untrusted code: QuickJS
+ships no filesystem, no network and no process API, every call it makes goes
+through the same door and the same workspace boundary a single request goes
+through, and eight separate ceilings mean `while (true) {}` terminates and rolls
+back. When it meets a decision a machine should not make — an ambiguous symbol
+resolving to three crates — it stops with the workspace untouched and asks,
+rather than committing a guess.
+
+The agent-facing surface is three tools: what a name is, do a stretch of work,
+fetch what the work did not send back. The other eleven are still there behind
+`--surface legacy`, as the control column.
+
+What is proven in a container is stage 57 of `verify.sh` and the program run
+against a directory-backed boundary; the vertical over a real Btrfs subvolume
+with the compiler running confined is stages 58 and 59. Whether any of it makes
+a frontier agent do more correct work with less effort is **not measured**. It is
+built to be measured next; no benchmark was run.
 
 **Not proven.** `thalyx_watch` — the filesystem watcher, ten BPF hooks against
 the LSM's two — has never been loaded by Thalyx's own loader; `bpftool` still

crates/thalyx-cli/Cargo.toml

@@ -27,6 +27,7 @@ thalyx-manifest.workspace = true
 thalyx-graph.workspace = true
 thalyx-know.workspace = true
 thalyx-rust.workspace = true
+thalyx-program.workspace = true
 thalyx-parser.workspace = true
 thalyx-memory.workspace = true
 thalyx-watch.workspace = true
@@ -67,6 +68,10 @@ thalyx-btrfs.workspace = true
 thalyx-install.workspace = true
 thalyx-manifest.workspace = true
 thalyx-sandbox.workspace = true
+# So a test can ask whether this machine has a rust-analyzer the same way the
+# binary does. Rule 3's skip has to be decided by the same search the thing
+# under test uses, or the skip is about a different machine.
+thalyx-rust.workspace = true
 
 [lints]
 workspace = true

crates/thalyx-cli/src/catalogue.rs

@@ -522,8 +522,10 @@ pub const VERBS: &[Verb] = &[
             "the_whole_system",
             "already_open",
         ],
-        summary: "Run several requests inside one reversible boundary, check the result, \
-                  and keep it or undo all of it — in one call.",
+        summary: "Run a short program — JavaScript, with loops, conditions and \
+                  assertions — inside one reversible boundary, and keep what it did or \
+                  undo all of it. What it looks at decides what it does next, so a \
+                  whole stretch of work is one call.",
     },
     Verb {
         id: "evidence",