STAR-ADR-001 Domain GServer and ZeroMQ Approval

• STAR-SERVER-000 Composable Intelligence GServer Domains
• SENTO-ZMQ-000 ZeroMQ Transport Runtime
• SENTO-000 Managed Component Runtime as the required generic runtime dependency, without approving unrelated future scope not required by the two linked designs

nsaspy approves the scoped domain-gserver¹ model and the explicit ZeroMQ² transport model on 2026-07-19.

Approval means the architecture is accepted for focused implementation planning. It does not claim that the runtime or transport has already been implemented, benchmarked, secured, or validated.

Use one extended Sento actor system³ per StarIntel server process by default.

Inside that process:

• one root domain supervisor owns the domain tree
• HUMINT, SOCMINT, SIGINT, cyber, BBP, and threat intelligence each receive a scoped child domain supervisor
• dispatchers are owned per domain by default
• subdomains may receive their own supervisor, dispatcher, router pools, limits, and transport gateway inside the same process
• a logical domain is not automatically a separate process
• a separate process is introduced only for deployment, scaling, privilege, memory, crash-containment, or language-runtime reasons
• shared workload dispatchers remain optional infrastructure rather than the primary ownership boundary

This is the approved boundary. Do not flatten all intelligence work into one undifferentiated worker pool, and do not create one operating-system process per label merely because the label is a domain.

Use ZeroMQ only at explicit component boundaries requiring one or more of:

• process separation
• language independence
• routing identity
• independent queue and overload policy
• process or host mobility
• failure containment
• ZeroMQ socket semantics
• Star Router transport

Ordinary actors inside one tightly coupled Sento subtree continue to use direct actor mailboxes.

Approved transport invariants:

• one ZeroMQ context per operating-system process
• one exclusive owner per ZeroMQ socket
• no socket sharing across unrelated dispatcher threads
• dedicated poller or input/output ownership for blocking work
• ROUTER and DEALER for addressed asynchronous command traffic
• PUB and SUB only for intentionally lossy event traffic
• PUSH and PULL only for equivalent one-way workers without keyed state
• explicit high-water marks, deadlines, message limits, monitoring, shutdown, and security
• no unrestricted Common Lisp reader input for untrusted messages
• no binding-specific object exposed through the StarIntel transport interface

The Common Lisp⁴ implementation first audits orivej/pzmq⁵ against the selected current libzmq⁶ version.

PyZMQ⁷ is a reference implementation and cross-language test peer. It is not the Common Lisp production dependency. Its mature stable-API coverage and test structure may be used to identify expected behavior, construct compatibility fixtures, and compare transport results.

The binding audit has exactly three possible outcomes:

1. adopt the existing pzmq revision when it passes the required matrix
2. fork and extend pzmq when its architecture and foreign-memory ownership are sound but modern coverage or tests are incomplete
3. create a new narrow maintained binding when the existing implementation is unsafe, structurally obsolete, or more expensive to repair than replace

Do not commit to a fork or rewrite before the audit produces evidence.

Treat the existing binding as unsuitable for direct adoption when one or more critical failures are confirmed:

• unsafe foreign-memory ownership
• use-after-free, leak, or finalization hazards
• missing stable libzmq functions required by the transport design
• missing or broken multipart messaging
• broken non-blocking send or receive behavior
• inadequate polling support
• missing socket-monitor support
• missing CURVE security support
• incorrect context termination or socket close behavior
• inability to configure required production socket options
• failure on supported SBCL and operating-system versions
• tests too weak to detect transport regressions
• API structure that cannot be wrapped behind a stable transport protocol without leaking raw foreign objects
• inactive or unreviewable code whose repair cost exceeds a small replacement binding

The phrase “start new” means a deliberately narrow C foreign-function interface⁸ around only the stable libzmq operations required by the approved transport design. It does not mean binding every experimental ZeroMQ function.

• SENTO-ZMQ-RESEARCH-001 PZMQ Binding Audit

The spike must pin exact commits and versions before reporting a decision.

• the domain model may proceed as a set of scoped actor trees rather than separate monoliths
• ZeroMQ remains an adapter beneath domain boundaries and Star Router rather than replacing local Sento mailboxes
• the binding layer is replaceable behind a stable Common Lisp protocol
• Python services may interoperate over the message envelope without forcing the Common Lisp server to embed Python
• implementation planning must begin with the binding audit and shutdown, ownership, and overload tests