Specify Lisp-shaped ALGAL workbench direction

docs/lineage.md

@@ -187,6 +187,37 @@ grants, recorded model effects, applicability checks, and total budgets remain
 its own requirements; the OptMem installer and global instruction block are not
 part of the integration.
 
+## Temper: contract-first behavior
+
+[Temper](https://github.com/nerdsane/temper/tree/1be4b7be003f35bdacfbc24f7f4eb7e77bdade48)
+is a policy-driven runtime in which agents describe application behavior as
+state machines, data contracts, policies, and sandboxed modules. The source
+reviewed on 2026-10-04 informs a proposed ALGAL direction, not a new dependency
+or evidence that ALGAL has implemented Temper's mechanisms.
+
+Its [verification-hardening decision](https://github.com/nerdsane/temper/blob/1be4b7be003f35bdacfbc24f7f4eb7e77bdade48/docs/adrs/0016-verification-cascade-hardening.md)
+identifies a concrete failure mode: a checker can silently accept assertions
+that its classifier does not understand, even when a runtime parser understands
+more. The decision calls for a shared parser, explicit unverifiable assertions,
+and minimized counterexamples. ALGAL should require checker/runtime agreement
+and keep unsupported properties unresolved. More verification layers do not
+repair a disagreement about the property being checked.
+
+Temper's [composite verifier](https://github.com/nerdsane/temper/blob/1be4b7be003f35bdacfbc24f7f4eb7e77bdade48/crates/temper-verify/src/composite/verify.rs)
+checks joint entity state and distinguishes verified, violated, and incomplete
+exploration. That distinction is useful for ALGAL's process, resource, and
+revision invariants. Its [shadow testing](https://github.com/nerdsane/temper/blob/1be4b7be003f35bdacfbc24f7f4eb7e77bdade48/crates/temper-jit/src/shadow.rs)
+compares two transition tables on supplied cases. Such comparisons expose
+revision differences on those cases; they do not establish unrestricted
+observational equivalence or authorize new live effects.
+
+The [ALGAL north star](north-star.md#contract-first-behavior-and-verification)
+selects executable contracts, typed host policy, staged verification, composite
+checks, shadow revisions, and recorded improvement decisions. ALGAL would
+express them through its existing manifests, applications, effects, and
+foundry evidence. Temper's CSDL/OData interface, Cedar stack, actor backend,
+and proof-tool selection are not required parts of that adoption.
+
 ## Research precedents
 
 The claim that nobody has thought of evolving AI programs would not survive

docs/lisp-source-experiment.md

@@ -0,0 +1,52 @@
+# Lisp-shaped source experiment
+
+Status: parity phase passed, 2026-10-06. This experiment is a decision input for the
+north-star language direction. It does not change the runtime, manifest
+contract, or production source language.
+
+The question is narrow: does a live, Lisp-shaped authoring surface make ALGAL
+programs faster for a person or model to change and repair while preserving
+ALGAL's bounded semantics, inspectable expansion, cross-runtime parity, and
+replayable evidence?
+
+The incumbent is the current `.algal` source language. The treatment is a small
+parenthesized language with symbols, literals, `let`, `if`, records, arithmetic,
+and hygienic-looking macros. Both must lower to the same `algal.organism.v1`
+manifest and the same pure `algal.expr.v1` cells. The treatment must never gain
+ambient evaluation, unbounded recursion, hidden effects, or authority through
+syntax.
+
+## Protocol
+
+Freeze a task set of at least ten small programs drawn from existing source
+examples. For each task, create equivalent incumbent and treatment programs,
+then ask the same model or developer to perform the same sequence of bounded
+edits, including one deliberate error repair and one semantic change. Record:
+
+- wall time from edit to useful diagnostic;
+- source bytes and model token count;
+- diagnostic location and repair attempts;
+- expansion size and digest;
+- compile and check time;
+- manifest and receipt digest equality;
+- replay verification time;
+- whether a reviewer can explain the generated expansion;
+- total source plus maintenance cost after the edit sequence.
+
+Use paired tasks and the same machine, toolchain, prompt budget, and fixture
+inputs. Report medians and individual task results. A treatment result is
+`insufficient evidence` if it compiles fewer than 90% of incumbent tasks, loses
+receipt parity, or has fewer than ten paired tasks.
+
+## Decision gate
+
+Adopt a Lisp-shaped source surface only if it improves median verified iteration
+time by at least 20%, keeps parity on every accepted task, and does not increase
+repair attempts or expansion-review failures by more than 10%. If it improves
+only source compactness, keep the current syntax and borrow macros or a live
+workbench selectively. If it improves the interactive repair loop but not batch
+source metrics, prioritize a debugger/condition interface rather than a new
+language. If it fails the gate, record the negative result and keep the current
+source direction.
+
+The current runner covers eleven paired fixtures and lowers each treatment through the real compiler. All eleven have exact manifest digest parity. Across the matrix, treatment source is 17.5% smaller in bytes (1,604 versus 1,945) and 42.6% larger in lexical tokens (472 versus 331). This is evidence for semantic viability, not yet evidence that Lisp improves verified iteration time. The next phase adds deliberate typo repairs and timed edit sequences. The proposed source-layer contract is recorded in [the workbench specification](lisp-workbench-spec.md).

docs/lisp-workbench-spec.md

@@ -0,0 +1,98 @@
+# Lisp-shaped ALGAL workbench
+
+Status: proposed source-layer specification, 2026-10-06. The workbench is an
+authoring and repair interface. It is not a second runtime and it does not
+change `algal.organism.v1`, `algal.expr.v1`, receipts, capabilities, or replay.
+
+## Boundary
+
+A workbench document is a bounded S-expression file. Compilation has four
+phases:
+
+1. read UTF-8 text into a syntax tree with source spans;
+2. expand only declared, pure macros under a compile fuel and output-byte bound;
+3. lower the expanded tree into the existing ALGAL source AST and manifest;
+4. run the same structural checks as `.algal` source.
+
+The output is the canonical manifest, source map, expansion digest, and
+compiler diagnostics. The runtime receives only the manifest. It cannot inspect,
+call, or re-evaluate the workbench reader or macro implementation.
+
+A workbench file may not perform host I/O, access environment variables, load
+arbitrary code, call a provider, allocate an unbounded structure, mutate a
+macro environment, or invoke `eval`. Macro expansion is deterministic for the
+pair `(source text, compiler version, macro library digest)`.
+
+## Surface
+
+The first version admits one top-level `program` form:
+
+```lisp
+(program quote
+  ((order json))
+  json
+  (with-total subtotal
+    (* (get order quantity) (get order unit_price))
+    (record subtotal subtotal
+            shipping (if (>= subtotal 50) 0 5)
+            total (+ subtotal (if (>= subtotal 50) 0 5)))))
+```
+
+Atoms are lowercase symbols, bounded numbers, JSON strings, `true`, `false`,
+and `null`. Lists are limited to forms in the standard library. The initial
+standard library contains `get`, `record`, `let`, `if`, `+`, `-`, `*`, `/`, `%`,
+comparisons, and `with-total`. A symbol is a binding reference, never an
+implicit host-language call.
+
+`program` has a name, a bounded parameter list, an output type, and one body.
+The parameter and output types are the same `text`, `json`, record, and list
+types accepted by readable ALGAL source. `let` bindings are immutable. There is
+no general lambda, closure, recursive definition, actor, effect, or durable
+wait form in the workbench surface. Those remain explicit ALGAL constructs and
+manifest contracts.
+
+## Macros
+
+A macro is declared in the workbench library, versioned, and admitted by the
+compiler. It receives syntax nodes with spans and returns syntax nodes. It may
+introduce bindings only through a hygienic `gensym` operation. User data is
+quoted with `quote`; generated syntax is unquoted with `splice`. Macro output
+retains an expansion stack so diagnostics can point to both the generated node
+and the invocation.
+
+Macros must declare a maximum input node count, output node count, and expansion
+fuel. Recursive expansion, mutual expansion cycles, and output over the bound
+are compile errors. The compiler records the library digest, each invocation's
+input digest, output digest, and the final expanded-tree digest in the source
+map. Two compilers must reject or produce the same expanded tree under the same
+contract version.
+
+## Errors and repair
+
+Reader, expansion, lowering, and structural-check failures use
+`algal.source-error.v1`. Every diagnostic contains a code, message, primary
+span, source digest, and bounded expansion stack. A repair client may request a
+candidate edit against a failed source snapshot. The compiler applies the edit
+in memory, reruns all four phases, and returns either a new candidate manifest
+or the original diagnostic. It never mutates a running process or receipt.
+
+A runtime failure remains a runtime failure. The workbench may open the same
+receipt-backed debugger used by readable ALGAL source, showing inputs,
+capabilities, prior evidence, and the failed transition. A repair can be tested
+against captured inputs and replayed before it becomes a new source revision.
+Resuming execution requires the normal activation and effect-reconciliation
+contracts.
+
+## Identity and review
+
+The source digest covers the exact workbench bytes. The manifest digest covers
+only the lowered ALGAL manifest. The expansion digest covers the canonical
+expanded tree. A receipt records the manifest digest and never treats source or
+macro text as executable authority. Reviewers can therefore inspect source,
+expansion, manifest, and receipt as separate linked artifacts.
+
+The workbench is accepted as a default authoring surface only after the paired
+experiment meets its gate: at least ten holdout tasks, exact manifest parity,
+median verified iteration at least 20% faster, and no more than a 10% increase in
+repair attempts or expansion-review failures. Until then it remains an
+optional development tool and readable ALGAL source remains canonical.

docs/north-star-execution.md

@@ -25,6 +25,16 @@ remain planned; neither the reader nor the job driver enables them by default.
 The [scoped-memory direction](north-star.md#scoped-memory-and-progressive-context)
 tracks that work; its reader foundation does not complete C0 through C4 below.
 
+The [contract and resource experiments](north-star.md#initial-contract-and-resource-experiments)
+add a follow-on direction: contract/runtime correspondence, mixed resource
+requirements, suspendable effects, and measured repayment of procedure-building
+costs. They do not silently enlarge C1 or complete any phase below. Each selected
+experiment needs a scoped implementation plan; C0 records affected consumers and
+C4 can use the resulting evidence. Cloud owns funding and hosting through its
+[companion north star](https://github.com/hraness/algal-cloud/blob/main/docs/north-star.md).
+Existing application/process mechanisms can support early fixtures without
+waiting for the whole actor-language plan.
+
 ## Constraints
 
 - Models propose typed programs or transitions. The host owns permissions,
@@ -51,6 +61,19 @@ tracks that work; its reader foundation does not complete C0 through C4 below.
 - Pin supported immutable artifacts or full source revisions independently in
   each consumer. Do not bind repositories to moving `main` branches or local
   sibling paths. Preserve historical programs, receipts, and experiment pins.
+- Portable resource requirements and host financial state have different owners.
+  ALGAL keeps deterministic work budgets, permission types, and recorded effect
+  semantics. Cloud or another host validates source backing, allocation terms,
+  tariffs, and external usage. A grant is not permission; a credential is not
+  funding. Add a shared record only for a demonstrated gap, with old-version
+  replay and Bun/Rust correspondence. A persistent allocation migration is its
+  own phase, with ownership mapping, dry run, and restore evidence.
+- Hosted consumer pilots reserve hosting independently of provider allowances,
+  including deterministic/cached work and retention. Their records name the
+  hosting payer, backed allocation, captured customer terms, and recovery
+  funding. Cloud's [hosting cost-recovery plan](https://github.com/hraness/algal-cloud/blob/main/docs/hosting-cost-recovery-plan.md)
+  owns collection and expense reconciliation. This does not impose Cloud
+  pricing on local ALGAL use or make live billing a core publication gate.
 - Each rollout has one ALGAL integration owner and one owner per consumer.
   Workers edit disjoint scopes; the integration owner updates this plan's status
   and joins evidence. Only explicitly authorized task-owned delivery proceeds.
@@ -250,15 +273,27 @@ cargo test -p xcb-runtime --locked managed_program
 - **Approach:** Start with two materially different validated workloads while
   other C3 migrations continue. Compare retained procedures with fixed-agent,
   no-library, fresh-synthesis, and conventional baselines under comparable
-  models, tools, information, and total budgets. Include maintenance and
-  migration costs. Follow the
+  models, tools, information, and total resource vectors. Include procedure
+  acquisition, failed trials, evaluation, maintenance, migration, retention,
+  and sponsored usage. Keep incompatible units separate. Distinguish actual
+  hosting expense, customer hosting charges, earned/collected hosting revenue,
+  unconsumed prepaid obligations, and subsidy. Include billing overhead and hold
+  tariffs/allocation rules fixed for execution comparisons. Resource-aware
+  pilots include a sponsored non-revenue workload rather than assuming all
+  backing arrives through customer payments. Freeze the horizon, quality/recovery
+  floors, sample/uncertainty method, minimum useful improvement, and stop rule
+  before search. Further tuning after confirmation requires a new sealed
+  holdout. Follow the
   [cumulative-skill experiment](cumulative-skill-experiment.md); retain failures
   and unknown provider usage. New core changes reopen their impact rows.
 - **Acceptance criteria:** Report held-out task success, correction effort,
   total cost, reuse, stale-work rejection, recovery outcomes, and adoption
   coverage with denominators. Evidence identifies the tested integration and
-  unverified claims. Each future contract, executor, storage, or workflow change
-  assigns consumer impact and follow-up owners before it is called complete.
+  unverified claims. A Cloud hosting pilot identifies its cost-recovery evidence
+  or unresolved status; a good procedure score cannot substitute for collected
+  hosting charges or qualified billing activation. Each future contract,
+  executor, storage, or workflow change assigns consumer impact and follow-up
+  owners before it is called complete.
 - **Validation:** Run the study and verification commands recorded for each
   workload, consume the exact C1–C3 conformance evidence, and independently
   review the comparisons. A mechanism-only outcome is a valid result when