id: design: dynamic user functions — server-compiled DLLs, hot-swap into running worlds without world recompile

Part of the worlds design program: #5955. Statements S36–S38 and S45 of the 2026-11-04 brief. This is the V3 stage of the program.

Requirement (Drew, in substance)

User-level code should be passable into a running world without recompiling the whole world:

At least in one version of the compiler there is a way to make a DLL. The server side compiles that DLL itself — user code is never trusted pre-compiled.
The platform then places the DLL in the appropriate location for the world-side code to call it.
If a user changes what's running, the world-side code picks it up as soon as it's compiled and available to be hot-swapped in.
Trust chain: the server can trust the code because it did the compilation itself; and the only non-pure things the user function can do are from the server's own platform being passed to it by the world author — and the world author can trust that chain too.

Design points to settle

Interface contract: what signature/shape a user DLL exposes, and how the world discovers and binds it (name, version, interface hash). Mismatch behavior: refuse, fall back to previous version, or run the user's prior published code (see the compile-economics child — "keep running what you'd already published" is the stated default).
Swap semantics: swap at tick boundary only? In-flight calls finish on the old code — state handoff between versions (the function's state is the world's problem, the function's problem, or serialized through a defined state type?).
Which Roc compiler line actually supports the DLL path Drew remembers, and what it costs us to build on it (pin vs track).
Isolation: a user DLL crashing or hanging must not take the world down (budgets: server-invariants child; per-function enforcement: gas/timeout research child).
Distinction from the authoring hot-swap loop (id world dev, #558 / #5541): that swaps world code for its author during development; this swaps per-user functions inside a live world for its players. Reuse its mechanics where they fit, but the trust and budget models differ.

Done looks like

A design doc: DLL interface contract, server compile pipeline, placement/binding, swap semantics incl. failure fallbacks, and the trust argument written out end-to-end.

CODE-1630

Wave-2 tie-in (finding F3) + contradiction C3.

F3 — already decided, inherited as a constraint (2026-10-08, founding session): "a server can also control access by what functions it allows in the roc interface and by only accepting untrusted code in source form, compiling the roc code itself and only using trusted sources." Source-only + server-compiles is not an open question in this design; it is the shipped posture and the brief's own trust argument.
C3 — WORKING INTERPRETATION — shown to Drew in the main chat 2026-11-04 ~23:06 and not objected to; recorded here as an interpretation, not a ruling. User-supplied hot-swapped functions move the 2026-10-31 boundary that native code is admin-installed and never peer-distributed. They reconcile via the brief's server-compiles-from-source rule, and this design must state the new boundary explicitly as a design constraint: server-compiled-from-source user functions are inside the boundary; shipped/pre-compiled binaries are not.

Record: workspace/scratch/worlds-capabilities-brief-2026-11-04/conversation-tie-ins.md (F3, C3).

Wave-2 follow-ups filed from the prior-art research (Lane B). Granular sub-scopes of this issue, each carrying the relevant research findings + citations:

id: research: Roc shared-library embedding reality check — what roc build library outputs actually exist
id: design: hot-swap alternatives — Wasm-component instantiation vs process restart with compile cache vs interpreted behavior layer
id: design: feature-object library attachment — runtime attach/detach of library behavior to entities without world recompilation

Research source: workspace/scratch/worlds-capabilities-brief-2026-11-04/prior-art-research.md. Full wave-2 mapping: workspace/scratch/worlds-capabilities-brief-2026-11-04/wave2-map.md.

Ruling — C3/C4 affirmed as platform pillars, with an iteration doctrine (Drew, 2026-11-04 23:57 CST).

Handling user code (this issue: server-compiled DLLs, hot-swap) and fuel budgets (#5966) are, in Drew's words, "very big parts of making this a platform that other people can build on top of, interact with, and reason about." They are top-importance, not side features.

Doctrine for this work:

Thorough research first; test what we find; actively look for holes and gaps.
Expect to rework and rebuild multiple times before landing at the right solution — iteration is the plan, not a failure mode.
Initial implementations may be locked to us in a test environment and need not be user-friendly in any way — but everything built must have at least the capability to become highly user-friendly later. No architectural dead ends on UX.

C3 substance stands as interpreted: user code is source-only, server-compiled (which is what reconciles hot-swap with the Oct 31 native trust boundary — see also #5996 for the alternatives exploration).

🤖 Agent note · handed off

Agent: repo queue worker, lane code-l (repo-worker-code)
Session / ID: cron repo-queue-worker-shift-l run 2026-11-08 11:58 CST; task 13258
Found via: queue claim · task 13258
Task: task 13258 for issue id: design: dynamic user functions — server-compiled DLLs, hot-swap into running worlds without world recompile #5964 (small_fix). Fresh check: issue id: design: dynamic user functions — server-compiled DLLs, hot-swap into running worlds without world recompile #5964 is OPEN, no hard-stop labels (held / user/owned / do-not-merge / do-not-auto-edit). Execution-lane assignment returned opencode - handed off to the opencode claimant, which launches the bound opencode session; this lane does not work it directly.
Expectation: claimant session drives task 13258 to a terminal state. Attempts 5/6.
Links: task 13258 · issue id: design: dynamic user functions — server-compiled DLLs, hot-swap into running worlds without world recompile #5964

Task 13258 (small_fix, PR #None): picked up by lane code-v, assigned_lane=opencode — handed off to the opencode claimant, which launches the bound session. Issue #5964 state OPEN. This worker will not work task 13258 directly.

🤖 Agent note · handed off

Agent: repo queue worker, lane code-j (repo-worker-code)
Session / ID: cron repo-queue-worker-shift-j run 2026-11-08 13:10 CST; task 13258
Found via: claimed task 13258 this shift; execution-lane assignment returned opencode
Task: Claimed task 13258 (small_fix) for issue id: design: dynamic user functions — server-compiled DLLs, hot-swap into running worlds without world recompile #5964 (attempt 5/6). Fresh check: issue id: design: dynamic user functions — server-compiled DLLs, hot-swap into running worlds without world recompile #5964 is OPEN, no hard-stop labels (held / user/owned / do-not-merge / do-not-auto-edit). Handed off to the opencode claimant; this lane does not work it directly. Task parked in the same pass per §1b/§9.
Expectation: claimant session drives task 13258 to a terminal state.
Links: task 13258 · issue id: design: dynamic user functions — server-compiled DLLs, hot-swap into running worlds without world recompile #5964

🤖 Agent note · picked up

Agent: repo queue worker (repo-worker-code), OpenChamber scheduled lane c8b9355e-319a-4640-8096-7ad19480d151
Task: task 13258, design record for id: design: dynamic user functions — server-compiled DLLs, hot-swap into running worlds without world recompile #5964
Fresh verification: Existing triage decision (task 12408) gated this design on research issue id: research: Roc shared-library embedding reality check — what roc build library outputs actually exist #5995 and alternatives issue id: design: hot-swap alternatives — Wasm-component instantiation vs process restart with compile cache vs interpreted behavior layer #5996. Both remain OPEN. PR docs(id): hot-swap alternatives decision — v1 is instance-per-function restart (#5996) #7637 proposes the id: design: hot-swap alternatives — Wasm-component instantiation vs process restart with compile cache vs interpreted behavior layer #5996 decision but remains OPEN, not merged.
Next: block this packet as packet_defect: it requests a final design while the documented premise/alternatives gates are unresolved. Do not decide the DLL premise blind.
Resume condition: id: research: Roc shared-library embedding reality check — what roc build library outputs actually exist #5995 evidence and id: design: hot-swap alternatives — Wasm-component instantiation vs process restart with compile cache vs interpreted behavior layer #5996 decision land, or the triage owner updates the gate.
Links: task 13258 · id: research: Roc shared-library embedding reality check — what roc build library outputs actually exist #5995 · id: design: hot-swap alternatives — Wasm-component instantiation vs process restart with compile cache vs interpreted behavior layer #5996 · PR docs(id): hot-swap alternatives decision — v1 is instance-per-function restart (#5996) #7637

🤖 Agent note · blocked (packet defect)

Agent: repo queue worker (repo-worker-code), OpenChamber scheduled lane c8b9355e-319a-4640-8096-7ad19480d151
Task: task 13258, design record for id: design: dynamic user functions — server-compiled DLLs, hot-swap into running worlds without world recompile #5964
Reason: task packet requests the design now, but the existing triage gate requires id: research: Roc shared-library embedding reality check — what roc build library outputs actually exist #5995 Roc shared-library evidence and id: design: hot-swap alternatives — Wasm-component instantiation vs process restart with compile cache vs interpreted behavior layer #5996 hot-swap alternatives first. Fresh state: both issues remain OPEN; id: design: hot-swap alternatives — Wasm-component instantiation vs process restart with compile cache vs interpreted behavior layer #5996 PR docs(id): hot-swap alternatives decision — v1 is instance-per-function restart (#5996) #7637 is OPEN and unmerged. Writing now would decide the DLL premise before those inputs land. No doc or source changes.
Resume condition: id: research: Roc shared-library embedding reality check — what roc build library outputs actually exist #5995 evidence and id: design: hot-swap alternatives — Wasm-component instantiation vs process restart with compile cache vs interpreted behavior layer #5996 decision land, or the triage owner updates the gate. Task 13258 blocked as packet_defect; issue labels moved from parked to blocked.
Links: task 13258 · id: research: Roc shared-library embedding reality check — what roc build library outputs actually exist #5995 · id: design: hot-swap alternatives — Wasm-component instantiation vs process restart with compile cache vs interpreted behavior layer #5996 · PR docs(id): hot-swap alternatives decision — v1 is instance-per-function restart (#5996) #7637

Navigation Menu

Repository navigation

id: design: dynamic user functions — server-compiled DLLs, hot-swap into running worlds without world recompile #5964

Requirement (Drew, in substance)

Design points to settle

Related

Done looks like

162 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id: design: dynamic user functions — server-compiled DLLs, hot-swap into running worlds without world recompile #5964

Description

Requirement (Drew, in substance)

Design points to settle

Related

Done looks like

Activity

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

162 remaining items

dezren39 commented on Nov 8, 2026

dezren39 commented on Nov 8, 2026

developing-today commented on Nov 8, 2026

dezren39 commented on Nov 8, 2026

dezren39 commented on Nov 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions