CL-HTTP and the Contributed Web Systems in Open Genera

Evidence, rights boundary, and inventory grain

The contribution was inspected inertly in the purchased Open Genera media. Its source, binaries, documentation payloads, Java class files, VRML scenes, and other licensed contents remain untracked. This article publishes original analysis, identifiers needed to reproduce the inspection, and short interface labels; it does not reproduce the source or bundled prose.

The purchased archive used here is:

Within that archive, the inspected contribution has the portable root sys.sct/contributed/cl-http/. It contains 531 files totaling 35,112,284 bytes. A manifest made by sorting every relative pathname bytewise and recording relative-path<TAB>byte-count<TAB>sha256 has SHA-256 7d6ec65adfaf4cd42773bbd7816856633ecd3ed94608f0e836ad8276781790f0. Two nested source-distribution archives provide an additional version boundary:

Selected source identities anchor the principal claims:

“Complete” in the command inventory below means every literal Genera define-program, application-frame, command-table, menu, command, fixed key/character binding, and presentation-to-command translator found by a recursive scan of the inspected highest-revision Lisp sources, followed by manual review of the matches and of macro-generated Showable Procedures commands. It does not mean every exported Common Lisp function, every HTML anchor, or every caller-generated Showable Procedures command. Those have different, explicitly stated grains:

• server, client, and proxy operations are inventoried as public operator-facing operations and configuration workflows, not as a package symbol dump;
• W3P, W4, and Lambda IR are inventoried by installed type, constraint, action, activity, and bundled UI;
• examples are inventoried by every source file and every named behavior group in the aggregate export file;
• browser form fields and buttons are controls, but they are not mislabeled as Genera keybindings or command-table entries.

Version and lineage

The local media contains several simultaneous version signals. The source distribution calls itself 67.87a-pre, while patch directories extend the server through CL-HTTP 67.91. Other subsystem patch directories identify Base Client 48.11, Client Substrate 1.17, Proxy 3.0, W3P 7.1, W4 39.3, Lambda IR 21.0, Showable Procedures 36.3, and Btree 34.0. These numbers describe independently patchable systems; they must not be collapsed into a fictitious single “67.91 release.”

The public Open Genera Beta II release notes identify the contributed families as CL-HTTP, the minimalist HTTP Base Client, W4, HTTP Proxy, and Lambda IR. Authorship headers in the inspected source give the more specific lineage:

Mallery's contemporary WWW94 paper describes CL-HTTP as a Common Lisp HTTP server intended to expose dynamic Lisp computation through the Web. That public architectural account and the Open Genera Beta II Release Notes provide product context; exact local behavior below comes from the identified source rather than from assuming that every historical CL-HTTP release was identical.

What is loaded in the base world

On 2026-07-18, the network-isolated Genera harness started a fresh session named d49-cl-http-readonly-20260718, generation 1, at 11:32:07 -04:00 and stopped it at 11:33:20 -04:00. One Listener expression performed only package lookup and non-loading system lookup. It did not load a system, start a service, export a URL, open a network connection, or write a file.

The result was negative for all of these packages:

HTTP, WWW-UTILS, URL, HTTP-CLIENT, HTTP-PROXY, W3P, W4, LAMBDA-IR, SPT, and BTREE.

It was also negative for all of these loaded systems:

CL-HTTP, HTTP-BASE-CLIENT, HTTP-CLIENT-SUBSTRATE, HTTP-PROXY, W3P, W4, LAMBDA-IR, SHOWABLE-PROCEDURES, and BTREE.

This establishes absence from that base world, not inability to load the contribution and not absence from all Open Genera worlds.

The portable execution identities are:

Relevant tracked harness-source identities at session start were:

The Guix toolchain manifest has SHA-256 3adae999bbe420182f22adc2499fcc82449a46eaf580a362de9c0e718fa6b37d at channel commit 230aa373f315f247852ee07dff34146e9b480aec. Principal versions were Guix 1.5.0, Python 3.11.14, Xorg Server 21.1.21, Bubblewrap 0.11.0, xdotool 3.20211022.1, ImageMagick 6.9.13-5, and GCC 15.2.0.

The selected main window was Genera on DIS-LOCAL-HOST, X window 4194310, at 1200 by 900 pixels and position (72,55). The ordered action log contains two intents and linked successful delivery outcomes; at stop it has SHA-256 7f41bb1bbb0a1c774456f89314151d259e3bba384cc47d3500c1ce43b20a5eed.

The VLM ran in separate user, mount, network, PID, IPC, and hostname namespaces, with a read-only Guix store and exact helper/X-socket exposure, no default or external route, and no guest-visible file service. Xvfb did not advertise MIT-SHM. The harness observed both required exact guest X-protocol substitutions before declaring the run active. Its one-shot RFC 868 responder recorded one validated raw-Ethernet request/reply and a separate successful exit.

The base and private world files were unchanged. Shutdown observed the prompt, sent and obtained acceptance of confirmation, and observed cleanup progress, then reached the already documented Cold Load cleanup deadlock and required bounded termination. Thus orderly_vlm_host_shutdown is false, forced_after_confirmed_shutdown_stall, forced_stop, and state_may_be_incomplete are true. See the Genera computer-use harness for the meaning of those fields. The harness did not invoke Save World or create a host-process checkpoint; save_world_performed and guest_checkpoint_created remain unknown. Unsaved Lisp state was discarded.

CL-HTTP server architecture

Complete direct Genera command, menu, and gesture inventory

The recursive scan found no direct define-program or application-frame definition anywhere in these systems, and no standalone Dynamic Windows menu. It found the following complete set of direct User commands, fixed keys, and presentation translators at the stated grain:

Showable Procedures is a command generator: each caller-defined procedure family receives a Show command and a Document-to-buffer command, and may receive a caller-selected key. A universal finite list of all commands that other loaded software could generate is therefore impossible. The table is complete for the definitions in this contribution: the primary CL-HTTP define family installs the named commands and Hyper-Shift-W; related define-macro, define-generic, define-variable, and define-constant forms file entries into the same tree. The document command has no fixed key in the inspected definition.

The HTTP password prompt uses a separate Username/Password window, but that is input prompting rather than a program, command table, or persistent menu. Browser links, form submissions, applet clicks, and VRML navigation are cataloged with their examples below and are deliberately not counted as Genera gestures.

HTTP clients

HTTP-CLIENT-SUBSTRATE is the lower layer needed by programmatic clients and the proxy. It supplies Genera network integration, client variables, request and response processing, and persistent connection management. It is sufficient for code that consumes HTTP entities without the extra user-facing integrations.

HTTP-BASE-CLIENT adds the Image Substrate, image media handlers, the three User commands above, and an S-expression browser. Programmatic operations cover retrieving headers or entities, deleting and putting resources, choosing an HTTP version, redirects, authentication prompting, byte ranges, and tracing. The separation matters: the proxy depends on the substrate, not on the complete Base Client UI.

The client defaults to persistent connections, retries, and timeouts described under server architecture. Authentication can open the separate credential prompt. No source-defined browser program, history window, bookmark manager, menu hierarchy, or keymap was found. Describing this as a Netscape-like interactive Web browser would therefore overstate the evidence.

HTTP proxy

The proxy's direct operator interface comprises Enable Proxy Service, Disable Proxy Service, Proxy Service Enabled P, and Export Proxy Interfaces, together with cache-object operations. Initialization creates a proxy database under the logical location http:proxy-cache;, constructs an HTTP cache with a default maximum of 10,240 bytes, and can enable the proxy as part of server initialization. Caching defaults true on Genera.

The request path handles GET, HEAD, OPTIONS, TRACE, POST, PUT, and DELETE. GET is the cacheable path. The relay removes hop-by-hop headers, appends Via information, and supports chunked and fixed-length transfer. For POST and PUT, it forces a new upstream request to HTTP/1.0 unless it is reusing an existing HTTP/1.1 connection.

Proxy authorization is particularly important. If *proxy-subnets* is unset, the code falls back to *secure-subnets*; a separate denial list can reject hosts. The subnet predicate treats no allowed-list as open except for explicit denials. Consequently, enabling the proxy with both allow lists empty can produce an open proxy. A museum or test host must bind the experiment to an isolated loopback network and configure an explicit allow list before enabling it.

The source contains unfinished work notes for error propagation, logging, performance, and cache expunging. Those notes, plus the experimental family status, are stronger evidence of prototype maturity than the mere existence of the enable command. No live proxy was started.

W3P: Web presentation types

W3P is a small, Web-oriented presentation system. It borrows the idea of a presentation type and view, but its output and input medium is HTML forms rather than a Genera presentation database. It supplies textual and HTML views, presentation-type inheritance, present and accept behavior, conversions from strings, type checking, and typed input errors.

The complete installed standard type inventory in the inspected source is 39:

t, boolean, symbol, null, keyword, number, complex, real, rational, integer, fixnum, ratio, float, short-float, double-float, character, basic-string, string, bounded-string, pathname, existing-pathname, completion, member, member-sequence, member-alist, subset-completion, subset, subset-sequence, subset-alist, sequence, sequence-enumerated, mixed-sequence, or, and, token-or-type, null-or-type, type-or-string, expression, and form.

HTML acceptance methods render radio buttons, checkboxes, text inputs, and pull-down selections as appropriate to the type. The default maximum text-input width is 72 characters. Release notes record a behavior change from returning NIL for invalid input to signaling input-not-of-required-type; the local source follows the typed-error model.

Bundled search pages expose basic functions, presentation functions, and presentation types. W3P defines no Genera program, menu, fixed key, or direct command in this contribution.

W4: constraint-guided Web walking

W4 is a programmable traversal engine, not an interactive graphical browser. Its control surface is define-activity, with-activity, and walk plus extensible constraints and actions. The default traversal is depth first; breadth-first and best-first alternatives are present. Host-name resolution defaults to never, request retries to five, retry wait to one second, and the user-agent string identifies the W4 constraint-guided walker.

Lambda IR and LambdaVista

Lambda IR models documents and document universes, position-dependent indexing formats, tokenizers, clusters, bit vectors, features, computations, constraints, and caches. It has a custom binary dump/load representation whose local format version is 4. Defaults include an initial vector size of 50, growth increment of 350, document type (:text), tag :server-base-text, pathname loading, standard labeling, a hard sparsification threshold of 37, and fractional threshold of 0.02.

LambdaVista is the bundled CL-HTTP search example. It constructs a tokenizer named tok and can index exported text and HTML URLs. Automatic index-on-export defaults off. Its default search path is /cl-http/lambdavista.html.

The search page has one string field of size 50 and submits with Return; no explicit submit button is generated by the inspected code. There is no authentication or subnet restriction on the example export. Positive search terms are combined as requirements, while terms beginning with minus exclude matches.

The page instructions describe plus-prefixed mandatory terms, but the parser only recognizes and strips a leading minus; it leaves plus attached to the token, while all ordinary nonnegative terms are already conjunctive. This is a source-visible documentation/parser discrepancy. It remains a TODO to observe whether the resulting tokenizer or another layer changes that runtime effect.

A Porter-style stemming implementation is bundled, but the inspected LambdaVista initialization does not automatically install it. Presence in the tree is not evidence that the search example stems queries or indexed text. Lambda IR defines no Genera program, menu, fixed key, or direct command.

Showable Procedures and Btree

Showable Procedures creates definition macros whose use records objects in an ordered tree. It then generates functions for showing and documenting the indexed objects, Zmacs Meta-X commands, optional key bindings, and mouse-sensitive definition presentations. CL-HTTP uses this to organize its server-defining forms rather than maintaining a hand-written static list.

The Btree system below it implements balanced in-memory binary-tree CLOS objects and graph commands. The word “journal” in the contribution's patch directories refers to Genera's source-patch journal mechanism, not to a durable B-tree transaction journal. This Btree is also distinct from the persistent B*-tree implementation inside Statice. See Statice: persistent-object and database environment for that separate system.

Bundled examples

This section accounts for every top-level Lisp example and each nested MCF/Twistdown/VRML example in examples/. “Controls” are the visible browser or plug-in actions encoded by the source. “Not run” means the behavior is source-established but was not activated in the licensed world.

The aggregate export file is executable configuration

examples/exports.lisp.~287~ is not a passive manifest. Loading it constructs realms and users, exports file trees and computed handlers, loads some example modules, and conditionally initializes other systems. It does not itself unconditionally call the final HTTP-service enable operation, but its side-effects prepare a large and historically unsafe surface. It must never be loaded unchanged on a museum host.

At the named behavior-group grain, its complete example surface is:

The Flower Layers form names Mona Lisa Tulip, Mixed Dutch Tulips, Bijou Violets, and Punk Chrysanthemum. It selects among four JPEGs with one form control and is the only bundled example in this audit that relies on Netscape Layers for visibility switching. The visual appearance and hashes are documented in the visual-assets dossier rather than reproduced here.

Security findings

The contribution is valuable precisely because it exposes how easily a powerful Lisp environment could be made interactive over the Web. Several examples are intentionally dangerous teaching artifacts:

• the remote-procedure-call endpoint applies a client-selected Lisp function;
• the browser Listener reads and evaluates Lisp;
• the authentication examples install fixed demonstration passwords;
• the source exports can expose proprietary implementation files;
• the public distribution export can expose a complete distribution outside one historical site conditional;
• server and CGI introspection can disclose configuration and request data;
• editing credentials, enabling services, loading configuration, PUT, and mail posting are state-changing operations;
• the proxy can become open when allow lists are unset;
• Digest authentication does not encrypt traffic;
• several public example forms have no authentication at all.

These are source-established properties, not an allegation that the probed base world was exposed. The probe found the systems absent and ran with no external network route. Any future live study should use a disposable private world, a loopback-only fixture network, explicit allow lists, no imported credentials or mail, and a source-specific list of exports rather than the aggregate file.

Source, release-note, and runtime discrepancies

The principal differences that must remain visible are:

Runtime screenshot status and exact TODO

The probe produced local before and after screenshots:

They remain in the ignored session tree. They prove only that a Listener reported the systems absent. That is not a meaningful visible state of a CL-HTTP application, and neither image has received the image-specific review required by the screenshot publication policy. Publishing one here would add decorative licensed-world pixels without supporting the application's visible behavior, so this page deliberately has no screenshot.

TODO — runtime UI and screenshot: make a disposable copy of the licensed world; explicitly load only the required contribution systems; configure a loopback-only client/server path with no external route, file service, aggregate exports, real credentials, real mail, or proxy exposure; exercise one harmless static export and one non-mutating client request; then capture the relevant browser or configuration state. Review that specific image under the repository policy before curating it. If the Web page must be viewed in a period external browser rather than on the Genera display, document that additional software and keep the Genera server and browser-network evidence joined.

Separate TODOs remain for the W3P write-method mismatch, LambdaVista plus-term parsing, the missing VRML parameter page, and visual confirmation of Java, HotSauce, VRML, Netscape Layers, and slide-show behavior. The last four may require historically compatible clients and should not be reconstructed by guessing.

Reproducibility and validation

Static inspection used byte-exact highest-revision files from the identified contribution, recursive searches for system declarations, program and command forms, key and translator definitions, export forms, HTML controls, defaults, security predicates, and TODO/commented definitions. Counts were checked against their defining forms rather than derived from documentation headings. The complete relative-path manifest anchors the denominator even where this article lists only selected file identities.

The live check used the repository's Genera Xvfb computer-use harness and recorded the session, generation, base and private VLOD identities, debugger, VLM, compatibility preloads, RFC 868 responder, configuration, namespace and Bubblewrap mode, selected window, action intents and outcomes, captures, private-world change status, shutdown stages, and forced-stop result in the ignored run record. The inspection was intentionally non-loading and non-networking.

Public references were live-checked on 2026-07-18:

• John C. Mallery, A Common LISP Hypermedia Server, First International World Wide Web Conference, 1994;
• Symbolics, Open Genera Beta II Release Notes;
• IETF, RFC 1945: Hypertext Transfer Protocol — HTTP/1.0;
• IETF, RFC 2068: Hypertext Transfer Protocol — HTTP/1.1.

The public references establish historical intent and release context. The licensed local source establishes the exact interfaces and defaults analyzed here. The runtime probe establishes only base-world absence. None silently stands in for another.