Repository navigation
id: design: compile economics — compiled-world/DLL caching, compile-cost penalties, premium gating #5965
Description
Part of the worlds design program: #5955. Statements S39, S43, S44 of the 2026-11-04 brief.
Requirement (Drew, in substance)
Compilation is a server resource and the economics must point the cost at whoever causes it:
- Penalty model: heavy compiles, and not using a pre-cached server-side object, are a penalty to that user. They just keep running the code they'd already published in the meantime — so a slow or expensive compile never stalls the world, and the cost lands on the user who triggered it, reducing impact to the world's performance.
- Caching: combinations of libraries and source code might represent a world; if they're compiled, that could be cached — and if somebody makes another world with the same platform and source code, it would be reused. Same for DLL-marked libraries (precompiled and cached).
- Premium gating candidates: being able to upload raw code that gets compiled, or having a game/world app cached semi-permanently, might be things servers charge for, mark as premium, or limit to admins, contributors, or patrons.
Design points to settle
- Cache key: (platform identity, source hash, dependency closure hash, compiler version) — what exactly, and who else may reuse an entry (same user only, same server, anyone)? A cache hit across users is a feature per the brief; say what it leaks (existence of identical source) and whether that's acceptable.
- Eviction: semi-permanent vs LRU; what "semi-permanent" means concretely for the premium tier.
- The penalty currency: wall-clock delay, quota of compiles per period, literal money, or some mix — and how it composes with the tick/gas budgets (server-invariants child of #5955).
- Custom-compiled platforms (capability-model child) are compiles too: same cache, same penalty rules?
- Free tier shape: what does a non-paying user get — pre-cached popular objects only, compiles with delay, compiles with a small quota?
Related
- Capability model (custom platforms) and DLL design children of #5955
- Server-side invariants child (budgets this design spends)
Done looks like
A design doc: cache-key and sharing rules, eviction tiers, penalty model, and the premium/admin/contributor/patron gating matrix — with defaults a server admin can change.
Activity
developing-today commentedon Nov 5, 2026
CODE-1631
dezren39 commentedon Nov 5, 2026
Wave-2 follow-ups filed from the prior-art research (Lane B). Granular sub-scopes of this issue, each carrying the relevant research findings + citations:
Research source:
workspace/scratch/worlds-capabilities-brief-2026-11-04/prior-art-research.md. Full wave-2 mapping:workspace/scratch/worlds-capabilities-brief-2026-11-04/wave2-map.md.dezren39 commentedon Nov 5, 2026
🤖 Agent note · done (triaged)
Verdict: CONFIRMED / still open — design unsettled, not implemented.
Evidence at current main (2026-11-05):
pkgs/id/src/world_compile.rsimplements on-the-fly Roc world compilation, admin-only: "Compilation is admin-only: it runs a compiler on attacker-chosen text, and the defense is limits (CPU, memory, file size, wall clock, bounded output), not trust." Limits in code:MAX_COMPILE_FILES = 8,MAX_COMPILE_FILE_BYTES = 128 KiB,MAX_COMPILE_TOTAL_BYTES = 256 KiB,COMPILE_TIMEOUT = 120s.Fix path scoped: follow-up task 10534 (small_fix, pilot queue) to produce the design doc #5965 asks for — cache-key/sharing rules (including what a cross-user hit leaks), eviction tiers (what "semi-permanent" means concretely), penalty currency and composition with budgets, and the gating matrix with admin-changeable defaults. Implementing the cache/penalty system itself is explicitly out of that follow-up's scope.
8 remaining items
developing-today commentedon Nov 5, 2026
🤖 Agent note · picked up
Merge pull request #6230 from developing-today/queue/10534-5965-compi…
developing-today commentedon Nov 5, 2026
🤖 Agent note · done
Done: PR #6230 merged (merge commit
b251b6312485) addingdoc/2026-11-05_design_id5965.md, settling every point in this issue's "done looks like": cache key (BLAKE3 over platform tree hash, source closure hash, DLL closure hash, compiler binary digest, target) and sharing scopes with the cross-user existence-leak analysis; eviction tiers with "semi-permanent" defined concretely (pin lapse + 30-day grace, quota demotion, safety invalidation beats pins); penalty currency (compile credits = measured compiler CPU-seconds, hits free, failures 25%, token-bucket delay that never stalls a published world) composed with — not merged into — the runtime fuel/gas budgets; custom platforms under the same rules plus admin scope approval; and the free/contributor/patron/admin gating matrix with admin-changeable config defaults (existing hard compile limits stay ceilings for all tiers).Linked implementation: issue #6235 (P1: shared cache, scopes, LRU, determinism proof, metering-only) is filed and references the design. P2 (penalty) and P3 (pinning/gating) are sequenced in the design's §7 and get their issues when P1 lands. This issue stays open as the design's review surface.