Network services and site utilities on CADR and Genera

The seven direct registrations

The final src/lmio/chsaux.113 snapshot directly adds these contacts to CHAOS:SERVER-ALIST:

TIME, UPTIME, BABEL, TELNET, and NOTIFY are not in this System 46 registration list. They are later System 303 evidence and must not be projected backward merely because the maintained file retains related code.

Hostat, Finger, and Name

CHAOS:HOSTAT sends parallel simple STATUS requests. With explicit host arguments it queries those hosts; without arguments it traverses known Chaos hosts. The implementation waits up to five seconds, allows a typed character to abort the wait, and prints each host's address, name, status, and subnet counters. This is a network query, not the local controller-status function that also bears the name STATUS.

The Finger client obtains the short user/session record, while Name uses a byte stream and can return directory-oriented fields such as user identifier, location, idle state, personal name, and group. The System 46 keyboard layer makes Finger a site navigation tool: Terminal Escape F defaults to the AI host, while numeric arguments select a prompt, local Lisp Machines, MC, or AI and MC. Those defaults are MIT site policy embedded in this snapshot, not a portable Lisp-machine user interface.

Dummy mail, raw remote disk, evaluation, and screen spying

The MAIL server reads the proposed recipient sequence so an older client gets a well-formed rejection, then directs the user to the message-sending facility. Describing it as a “mail server” without the dummy qualifier would falsely imply delivery, queuing, or mailbox storage.

REMOTE-DISK accepts three command families:

The write path can destroy a band, filesystem, or label. The museum will not run it against preserved disks. Its presence is documented because it explains historical maintenance capability, not as an operational recommendation.

System 46's remote evaluator is off by default. It accepts a connection only when explicitly enabled or when no user is logged in. When admitted, it reads Lisp forms, evaluates them in the machine, and returns results. The SPY contact similarly crosses an important boundary by exposing a screen. Both should be treated as trusted-site-era facilities rather than exposed on an untrusted modern network.

System 46 elevator and door controls

Three tiny functions expose how tightly the machine could be integrated with its building and neighboring hosts:

The keyboard layer binds Terminal Escape D to the door buzz and Terminal Escape E to the elevator, conditionally advertising them only on the relevant floors and beeping after the request. The companion PDP-10 MIDAS program maps D, 8, and 9 to hardware operations: the door path remains energized for about three seconds and the elevator path for about one third of a second. These durations are historical implementation facts, not instructions for recreating or contacting a building-control service.

In maintained System 303 the corresponding function and keyboard forms are inside comments or block comments, and the live probe found neither SI:CALL-ELEVATOR nor CHAOS:HACK-DOOR fbound. This is direct evidence of removal from the active world, not merely a missing network route.

Other site-specific clients

System 46 includes a LIMERICK client to the MC host. Maintained System 303 retains or adds small clients whose names encode their historical site:

They are clients of external site services, not local daemons. Their exact remote results cannot be reconstructed from the Lisp-machine code alone and were not requested over the isolated museum network.

Exact live registry

The fresh System 303-0 probe evaluated (MAPCAR #'CAR CHAOS:SERVER-ALIST) and returned, in order:

STATUS, BAND-TRANSFER, FINGER, NAME, TIME, UPTIME, MAIL,
REMOTE-DISK, BABEL, DUMP-ROUTING-TABLE, EVAL, TELNET, NOTIFY

That is thirteen total contacts. STATUS and BAND-TRANSFER are registered outside the auxiliary service file; the remaining eleven come from the later chsaux.lisp. The screenshot preserves the exact Lisp list, the two sensitive default values, and a small function-cell probe:

Runtime observation, 2026-07-18: public LM-3 System 303-0, after reading the service alist, EVAL/TELNET gates, and six function cells. No service or hardware operation was invoked. This low-resolution frame is published as research evidence under the capture-specific fair-use review; MIT and other applicable interests are not licensed by this repository, and no endorsement is implied.

Query, time, notification, and diagnostic services

SPELL is a client of a configured external spelling service, not a server in the thirteen-contact list. CHATST is likewise not a network service. It is a low-level Chaos-interface board test with register reads/writes, packet loops, resets, echo, buzz, monitor, status, and soak/continuous tests. It was not run and belongs in D51.

EVAL and TELNET are active attack surfaces in this band

The maintained source initializes both CHAOS:EVAL-SERVER-ON and CHAOS:TELNET-SERVER-ON true, and the runtime probe observed (T T). The evaluator reads forms, evaluates them, and prints all returned values. The Telnet server emits a Lisp-machine herald, performs a small set of Telnet negotiations and character translations, then enters the machine's Lisp top level. These are remote access to the Lisp environment, not protocol diagnostics.

The preservation harness had no external route and did not establish a Chaos peer, but isolation is not a substitute for documenting the defaults. A restored System 303 world should not be bridged onto an untrusted network without first disabling or confining these contacts.

Registration is separate from enablement

NETI:DEFINE-SERVER records a service name, medium contract, function, policy, and execution options. The framework supports byte-stream and datagram servers and can either call a simple handler or create a managed server process. Direct options cover host, network, and address acceptance; trusted-host rejection; process and who-line behavior; EOF and close handling; and error disposition.

The important defaults are conservative relative to System 303:

• a defined server rejects an untrusted requester unless the definition overrides that default;
• active server processes normally appear in who-line/service state;
• a non-simple handler runs inside the secure-server environment with LMFS access groups restricted;
• an unspecified error disposition produces a notification, while definitions can request notification, debugger entry, or ignore behavior explicitly;
• active server instances can be described or closed, and their transient list is cleared on warm boot.

NET:*SYSTEM-SECURED* was NIL in the preserved world. The configured standard service selection was :ALL, but the live enabled-service set was NIL. These are not contradictory: the first says which services the site considers standard if services are enabled, while the second says none are currently accepting requests. Before-cold initialization disables the set, and the initial site dialogue decides whether to turn services on.

The direct operator controls are:

Requests are rejected when the service is disabled. A service configured to reject untrusted peers is also rejected when its trust test fails. The IP/TCP package guide adds a site-level rule: Internet hosts or subnets must appear in the site's secure-subnets attribute or access is denied, whereas an absent Chaos entry was historically treated as trusting Chaos hosts. That asymmetry is important when restoring an old namespace.

The live Genera boundary

The runtime probe read only the registry and policy variables. It found 47 registered core services and these selected registration/enablement pairs:

The absent final three belong to optional systems not loaded in the base world. The visible startup notice independently said that servers were disabled.

Runtime observation, 2026-07-18: licensed Genera 8.5 base world, isolated session d46-network-services-genera-20260718, generation 2. The researcher-entered probe read policy and registry state only; it did not enable or contact a server. The minimal functional screen is published beside critical analysis under the capture-specific fair-use review. Symbolics rights are not licensed by this repository, and no affiliation or endorsement is implied.

Server output and privacy controls

The core Lisp-machine Finger server keeps distinct cached strings for trusted and untrusted requesters. Site variables can suppress software and hardware information, WHOIS data, project and supervisor fields, work address and telephone, and home address and telephone. A site can also override the displayed location. The LISPM-FINGER service accepts untrusted requests, but its response is filtered by that policy rather than exposing the trusted cache unchanged.

NAME and ASCII-NAME accept an optional user and a /W-style request for fuller information. They can return the current user and, where directory data exists, selected WHOIS fields. This is user-directory information; it is not the Domain Name System and it does not prove a site has configured a directory database.

Complete Show Users option surface

The directly exposed Show Users command accepts these target forms:

• user, user@site, or user@host;
• @site or @host; and
• a sequence of targets, defaulting to the local site when none is supplied.

Its direct options are:

The output is presentation-sensitive. Selecting a displayed user can invoke a detailed Show Users request, while selecting a host can invoke a normal request.

Function F is a pop-up interface over the same machinery. With no numeric argument it uses the login/default site selection. Argument zero reads or prompts for a site; argument one selects local Lisp Machines. Site dispatch can map a wildcard, numeric argument, or absent argument to login-associated, local, all, prompted, or explicit hosts. Its standard display maps to normal format. The pop-up refreshes on a character and accepts a command presentation selected with the pointer. These mappings are source-defined behavior, not inferred from the key's letter.

The optional example Finger server

examples/server-finger.lisp is a substantial sample application, not the core Finger contact. When loaded and enabled at a designated :server-machine, it builds caches for Lisp Machine and non-Lisp-machine results and supports:

It regards idle time below one hour as busy, refreshes primary observations every ten minutes, retains last-seen host data for 24 hours, updates its database file every six hours, and constrains output width to 116 columns within an accepted 80–132 range. Site properties can exclude hosts. A companion SITE-NAMES contact returns matching host-prefixed groups and terminates them with *.

Warm/now initialization enables the cache and schedules a first scan after 15 minutes, but only on a host designated as a server machine. Neither this example nor its SITE-NAMES contact was present in the preserved base world, so no output or cache refresh was exercised.

Complete command inventory

The inspected dispatcher implements exactly these 31 FTP commands:

The only SITE subcommand in this implementation is EXPUNGE. The default HELP list omits SITE even though the dispatcher and per-command help implement it. The source header calls the implementation RFC 765, while its own HELP response names RFC 959. Those are genuine internal documentation discrepancies; this article does not silently choose one as the full conformance claim.

Session, file, and security behavior

The server begins at the local root and changes to the selected user's directory after USER/login. It supports both active and passive data connections. Transfer mode can be stream or block; file structure is file-only; type can be ASCII, image with eight-bit bytes, or local with an explicit byte size. STAT without a pathname reports connection endpoints, data state, type, mode, and structure; with a pathname it emits file properties or a listing.

An untrusted client is rejected when the system is not operating as a secured server. When an untrusted connection is admitted under secured operation, the code forces nonpermissive access-control behavior and login. PASS, DELE, MKD, RMD, RNFR/RNTO, STOR, STOU, APPE, and SITE EXPUNGE deserve particular care because they authenticate or mutate persistent state. None was run here.

Peek TCP

Peek's TCP display has a checksum meter and collapsible connection records. Each connection reports the host and state, local and foreign ports, average round-trip time and deviation, suggested retransmission timeout, current retransmission delay and count, next retransmission, read and send sequence/limit state, receive and send windows, congestion window, and slow-start threshold.

The direct connection menu is exactly:

Close is disruptive and was not selected.

Complete Listener diagnostic surface

These are implementation diagnostics, not end-user FTP commands. Header dumps can contain addresses, ports, sequence information, and payload-adjacent state, so they should not be published from a real site without a separate privacy review.

System 303 probe

The function-cell probe returned true for CHAOS:HOSTAT, CHAOS:WHOIS, and CHAOS:EFTP-TEXT-FILE-TO-ALTO, and false for CHAOS:CHATST, SI:CALL-ELEVATOR, and CHAOS:HACK-DOOR. It establishes only the load band's entry-point boundary. No true result proves that the external peer or hardware was available.

Genera probe

A generation-1 preflight used the Python entry point outside its required Guix wrapper and failed before the VLM ran. It supplied no guest input and is not runtime evidence about Genera.

Public System 46

Public maintained System 303

All paths are under System check-in 4df393c unless the associated Chaos or site revision is explicitly required by the harness provenance.

Licensed Genera source and installed Help

These hashes identify local evidence without publishing the proprietary contents.