Compiled parallel and cluster tasks

The unpublished development compiler lowers an admitted typed parallel.repeat task and its checked helpers to C++20. Local repetitions invoke compiled functions through Aner's existing bounded CPU executor. A cluster selects explicitly enrolled copies of the matching compiled program through protected process pipes and the versioned ANERNATIVE/2 binary protocol. Neither route sends source for interpretation or enters an Aner interpreter.

C++20 remains the required baseline. Downloaded Aner runtime packages do not include a usable native compiler SDK. Compiled parallel tasks remain a source build capability until a separate SDK artifact is reviewed. Build with the matching development source build SDK and keep the executable, generated C++ and JSON build manifest together. The development source includes Windows local process workers as well as POSIX workers. Linux and Windows execution checks are prepared but deliberately deferred at the user's request; implementation availability is separate from a recorded platform pass. No website, compiler package or extension publication accompanies this source change.

Windows process cluster support is enabled only for this compiled ANERNATIVE/2 route. The older ANERPAR/1 fixtures, interpreter/session repetitions and neural/regression worker protocols retain explicit Windows launch guards. Implementing the lower level process adapter does not silently enable those different protocols. Build and run the compiled executable; Run File and aner run retain source interpretation and do not compile or select these workers.

Build and run the local example

From the source checkout, using its matching development aner executable:

aner check examples/parallel/native_repeat.aner
aner build examples/parallel/native_repeat.aner -o native-repeat
./native-repeat --aner-native-info
./native-repeat

Windows PowerShell uses an explicit executable suffix and invocation:

aner check examples/parallel/native_repeat.aner
aner build examples/parallel/native_repeat.aner -o native-repeat.exe
.\native-repeat.exe --aner-native-info
.\native-repeat.exe

The complete local example declares a directly named typed task, scalar parameters and an explicit output shape. It compares every output value and derived seed between one worker and automatically admitted local execution, then prints true, 8, 2 and Float64. The build starts no task and no worker. --aner-native-info prints compiled program identity and execution policy before user top level statements execute. Running without this information flag executes the program.

The compiler keeps native-repeat.cpp and native-repeat.build.json by default. Choose fresh paths; existing destinations are rejected. --emit-cpp FILE and --emit-manifest FILE select explicit paths. The manifest identifies source and generated code hashes, runtime ABI, compiler/target, matching runtime build configuration (runtime_configuration), strict numerical policy, compiled capabilities and the static task registry. Capabilities describe the compiled binary’s admitted surface; they are not proof that a physical host or transport was tested. The internal ABI is native-subset-v3 and worker protocol is ANERNATIVE/2; earlier generated artifacts and worker copies must be rebuilt with the matching SDK. A source hash alone is not a complete installed library or hardware identity.

aner check checks the general language without starting tasks or reading a private cluster file. aner build additionally rejects constructs outside the compiled subset. A successful ordinary check does not establish native support. Unsupported source receives an Aner location; there is no interpreter fallback or automatic retry through aner run.

Typed task boundary

The existing source signature is retained:

fn simulate(parameters: List, iteration: Int64, seed: Int64,
            output: OutputRegion<Float64>) -> Unit {
    let factor = cast<Float64>(parameters.get(0))
    output[0] = factor * Float64(iteration)
}

This declaration illustrates the type boundary; the linked complete example supplies the surrounding call and checks. task: must name a checked top level function directly. OutputRegion<Int64>, OutputRegion<Float32> and OutputRegion<Float64> are the supported compiled result types. The task returns Unit; every result cell is written through its exclusive region.

Unrestricted Any or object values, mutable or nested Lists, mutable array captures, FrozenArray inputs, classes, scientific/contextual objects, Tensor/model execution and GPU kernels are outside this compiled increment. Scalar tag Any values may be retained or passed as admitted parameter transport, but require an exact concrete cast before arithmetic, comparison, printing, type/dtype inspection or numerical storage. This is not unrestricted dynamic execution. type retains the nominal List name, while dtype reports Any for a scalar List and Int64 for a Range, as in interpreted Aner; undefined dtype inspections reject with a located compiler diagnostic. The broader interpreted task API's supported values do not imply native support.

Tasks cannot capture mutable globals, print, perform file/network/database/credential operations, start nested parallel work or use other rejected effects. Addressed random.uniform, random.integer, random.normal and random.bernoulli calls use the existing native random functions with explicit seed/draw identities. Mutable generators, entropy acquisition and other random operations are outside this compiled slice. Passing a seed does not implicitly create a generator or alter its draw addressing. An API name or existing interpreter implementation does not establish native lowering.

The execution context must be a CPU simulation context with the existing Float64 context marker; this marker does not convert declared Float32 task arithmetic or output into Float64. A neural device or incompatible precision context rejects before tasks start. The compiler retains source order evaluation, checked integer overflow, exact implicit conversions, Float32/Float64 distinctions and bounds diagnostics. It disables fast math and floating contraction. Changing worker counts does not select reduced precision or permit numerical policy changes. Platform libm, compiler and provider behavior retain their documented portability limits; matching source is not a universal cross platform bitwise guarantee.

Ownership, coverage and failure

Each invocation receives an exclusive output lease, enforced by the existing typed output builder. A region belongs to its task and worker thread. The lease is revoked when that task finishes or aborts. Escaping a region, writing another task's region or using a completed lease is not admitted. Shape and index checks remain active, and numerical output values must satisfy the existing finite storage contract.

Windows ordinary cleanup requests job termination and observes both the direct child and an empty job before returning. The job handle remains owned throughout cleanup; there is no timed detach or breakaway. Unexpected OS termination/wait/query failure is fail stop rather than a successful return with unobserved workers. Kernel process reaping, like POSIX reaping, has no universal wall clock guarantee; the protocol's I/O deadlines and cooperative task checkpoints describe separate bounds.

The builder checks coverage before publishing a complete result. Missing writes, invalid accesses, nonfinite writes or task failures abort the operation. All submitted work is joined or stopped before control returns; there is no successful partial OutputResults. Ordered results refer to the requested global iterations even when completion order differs.

Fresh local state prevents task reuse from accumulating previous invocation state. Flat parameter storage is immutable and can be shared read only. The native array quota remains per execution context; it is not process wide admission across every concurrent task, retained result and provider allocation. Per task and result limits must be distinguished from process RSS.

Loop/function checkpoints allow cooperative stopping when an operation fails or its coordinator stops work. They do not preempt an arbitrary native provider call or establish a universal wall clock bound on local scientific code. Native tasks have no interpreter AST step counter. Function calls retain the native call depth guard described in native compilation.

Explicit limits and methods

A zero sized output dimension is not permission to omit an invocation: task identities and declared iterations remain explicit even when their region contains no cells. These configurable/admitted bounds are distinct from integer overflow and malformed protocol checks. No test intentionally exhausts physical memory.

Supported compiled region operations are len, is_empty, rank, bytes, shape, strides, get, set, fill and checked multidimensional brackets. Result operations are rows, cols, len, is_empty, rank, bytes, seed with or without an iteration, workers, seconds, summary, shape, strides, get, value and checked multidimensional brackets. Managed result, coverage, region control and retained output accounting is available in the scoped summary() fields. The corresponding native C++ adapter observers used by tests are not separate Aner source methods. is_resident() is false; collect() retains the already materialized result rather than retrieving remote resident shards.

Persistent worker caches, resident results, immutable array input transport and zero copy shared numerical input are not implemented in this increment. The separate interpreted cluster route retains its own more extensive input/result capabilities on its supported platforms; the new Windows compiled route does not enable it.

Prepare enrollment and preflight (development)

Use the matching development aner to prepare private records and check them before an explicit run. enroll creates new files only; it does not append to or replace an existing configuration. If a reviewed private configuration already exists, use it directly with preflight. Choose fresh receipt/plan names as well.

aner parallel native enroll --config native-cluster.conf \
  --worker Atlas-01 approved-win aner-native-trajectory 1 \
  --worker Atlas-02 approved-second aner-native-trajectory 1 \
  --windows-executable C:/AnerWorkers/trajectory.exe \
  --server-plan native-cluster.server-plan.txt \
  --receipt native-cluster.enrollment.json

Replace the public worker identifiers, previously approved SSH aliases and server enrolled service identifiers with your intended records. Repeat --worker ID SSH_ALIAS SUBSYSTEM CPU_SLOTS for one through 32 workers, with unique identifiers/SSH aliases and at most 256 total CPU slots. Each record uses the compiled ssh-subsystem route. The CLI validates all records and fresh output paths before publishing a private configuration. POSIX files are owner only; Windows files use a restricted current user DACL. Permission checks remain active when the configuration is read later.

Enrollment makes no network connection and does not install a program, enroll a host key, change known_hosts, edit user/server SSH configuration, change the registry or activate a service. It emits a sanitized preparation receipt, not a worker admission pass. The optional --windows-executable and --server-plan must be supplied together. They produce a private, review only server stanza plan for the fixed ASCII .exe path; a server operator must review its location, permissions, runtime dependencies and byte transparent launch contract before installing/activating anything. The service-name/path boundary and Windows shell restrictions below still apply. A new configuration is not a new SSH trust decision.

After building the matching compiled program and completing operator approved server/host-key enrollment, run a preflight:

aner parallel native preflight --program ./native-cluster \
  --config native-cluster.conf --task square --timeout 10 \
  --receipt native-cluster.preflight.json

For PowerShell, select the Windows compiled program explicitly:

aner parallel native preflight --program .\native-cluster.exe --config .\native-cluster.conf --task square --timeout 10 --receipt native-cluster.preflight.json

--task selects a registered compiled task; omitting it selects the first registered task. The callback is not invoked. --timeout is the total transport check deadline in seconds (default 10, permitted 1 to 120), not a promise that OS process reaping has a universal wall clock bound. Preflight checks every configured record, rather than selecting records according to a workload's iteration count.

The selected, approved native program enters a reserved preflight mode before its Aner source level statements. It checks the private configuration snapshot, expected program/runtime identity, selected task registration, requested CPU admission, exact C++20/ABI/protocol and the all 256 byte echo. A separate preflight acknowledgment closes the protocol before INIT, scientific parameters or RUN. The receipt records zero tasks and no scientific parameters, along with the configuration hash, program/runtime identities and scoped worker observations. Private endpoints, raw subsystem names and configuration paths are not public receipt fields. Output receipts use fresh private files; failures return nonzero and never authorize a task run or an interpreter fallback.

Select only an approved program built with the matching development SDK; this facility does not sandbox an arbitrary executable. A pass describes that configuration/binary/host observation at that time. It does not lease future CPU capacity, validate workload output/shape/memory requirements, attest remote hardware or prove scientific correctness. Every later cluster run repeats its own admission checks. Changing a configuration, binary, key policy or server mapping requires a new check; a receipt does not weaken SSH host key verification. Unknown host keys and authentication failures remain failures, without trust on first use or an accept-new retry.

VS Code exposes Aner: Prepare Native SSH Enrollment and Aner: Preflight Native SSH Workers for a saved .aner source context in a trusted workspace. They select the configured development runtime and pass literal CLI arguments. Enrollment collects explicit worker records; preflight asks for the approved compiled program, private configuration and fresh receipt. Neither command builds or runs scientific tasks automatically. See VS Code.

Enroll compiled CPU workers

Build the complete cluster example and inspect its information output. The configured executable is the compiled program for this source, rather than the general aner source/session engine. Every worker needs a build for its own OS/architecture with the same admitted source, native implementation contract, ABI and strict numerical policy. Required shared provider libraries must be installed there as well. The compiler uses the source build SDK’s matching configuration; runtime/iterator ABI settings, especially MSVC Debug versus Release, cannot be mixed arbitrarily.

aner build examples/parallel/native_cluster.aner -o native-cluster
./native-cluster --aner-native-info

Prepare native-cluster.conf in the directory from which the compiled example is run. The source names this explicit private file; it is not discovered or generated automatically. A same host two process configuration has the established schema:

ANER_CLUSTER 1
worker "Atlas-01" local "-" "/absolute/path/to/native-cluster" 1
worker "Atlas-02" local "-" "/absolute/path/to/native-cluster" 1

Replace both absolute paths with the built program's real path, then protect the file on POSIX with chmod 600. Two admitted local processes require at least two effective CPU slots. Multiple local records share the coordinator's discovered allowance; their separate process identities do not create additional CPU capacity. The current scheduler selects the first min(iterations, configured process count) records. Additional configured records are not started. Use at least as many iterations as configured processes when verifying that every enrolled process contributes; inspect the actual worker list in the receipt.

Windows local workers

Build native-cluster.exe, then prepare the same private text schema with absolute drive paths. Local executable paths are UTF-8 and may contain spaces or Unicode; use quoted forward slash paths such as "C:/Research tools/native-cluster.exe". Drive relative paths, UNC paths and device namespaces are rejected. There is no command shell expansion.

aner build examples/parallel/native_cluster.aner -o native-cluster.exe
.\native-cluster.exe --aner-native-info

The configuration must be a regular, current user owned file with a non null effective DACL permitting only that user, SYSTEM or Administrators. Reparse points are rejected. Aner verifies ownership/permissions and reads the bounded contents from the same opened handle; it does not follow a leaf symlink or reopen a different file after checking it. Prepare a new file before writing private configuration text:

$config = Join-Path (Get-Location) 'native-cluster.conf'
New-Item -ItemType File -Path $config -ErrorAction Stop | Out-Null
$user = [Security.Principal.WindowsIdentity]::GetCurrent().User
$acl = [Security.AccessControl.FileSecurity]::new()
$acl.SetOwner($user)
$acl.SetAccessRuleProtection($true, $false)
$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new(
    $user, [Security.AccessControl.FileSystemRights]::FullControl,
    [Security.AccessControl.AccessControlType]::Allow))
Set-Acl -LiteralPath $config -AclObject $acl
[IO.File]::WriteAllText($config, @'
ANER_CLUSTER 1
worker "Atlas-01" local "-" "C:/Research tools/native-cluster.exe" 1
worker "Atlas-02" local "-" "C:/Research tools/native-cluster.exe" 1
'@, [Text.UTF8Encoding]::new($false))
.\native-cluster.exe

Replace the example executable paths before running. The explicit no BOM UTF-8 encoding works with Windows PowerShell 5.1 as well as newer PowerShell. The ACL recipe removes inherited access and grants only the current user; it is not a network share enrollment recipe. The process adapter launches the validated executable with UTF 16 CreateProcessW and CRT argument quoting, allows only its three worker pipe handles to be inherited, and supplies the kill on close Job Object in the process creation attribute list. It verifies membership while the child is suspended before resuming it. This path requires Windows 10 / Windows Server 2016 or newer. Cleanup owns the direct process and its job descendants; unavailable job admission rejects the launch. Microsoft documents the handle/job creation attributes and job lifetime rules. Bounded overlapped I/O observes cancellation completion before releasing its buffers, following the CancelIoEx lifetime requirement. These mechanisms do not sandbox the already trusted worker program.

POSIX SSH workers

For an enrolled POSIX command shell, use a previously enrolled and host key verified alias:

worker "Atlas-03" ssh "approved-peer" "/opt/research/native-cluster" 1

This is a configuration record, not an instruction to contact an unconfigured machine. SSH retains batch authentication, strict host key checking and portable absolute executable path validation. The ssh record retains an enrolled POSIX shell and portable absolute path. Windows coordinators use the installed system OpenSSH client at C:/Windows/System32/OpenSSH/ssh.exe; Aner does not install it. A remote Windows worker uses the separately enrolled native subsystem route below, rather than placing a Windows command in this record. Keep keys, host addresses and private connection details out of source and public artifacts. A local only configuration needs no SSH client/server. See cluster enrollment for the established configuration/host-key rules, while retaining the compiled worker identity above.

Native SSH subsystems, including remote Windows hosts

Use ssh-subsystem for an explicitly registered native service on a remote Windows host:

worker "Atlas-03" ssh-subsystem "approved-win" "aner-native-trajectory" 1

The quoted fourth field is a subsystem identifier, not an executable path or command. It is separate from the local/ssh executable field. Use 1 to 64 ASCII characters: a letter first, followed by letters, digits, underscore or hyphen; separators, whitespace, shell metacharacters and command arguments are rejected. The native coordinator requests an SSH subsystem with -s and no PTY, retaining batch authentication, strict host key checking and the existing timeouts. It sends no client selected Windows shell command, remote path, script, source text or package install instruction. No fallback to ordinary SSH command execution is attempted. The native launch also disables forwarding and local client commands, overrides remote command substitution, and keeps stdin and the owned foreground SSH process rather than a multiplexed/detached connection. Authentication and any approved proxy route remain trusted SSH configuration.

A trusted server administrator must first install the matching compiled program and enroll a dedicated service. For a Windows OpenSSH server, a conservative server side example is:

Subsystem aner-native-trajectory C:/AnerWorkers/trajectory.exe --aner-native-worker

This is an example for the server's private sshd_config, not a file that Aner creates or edits. Use a fixed absolute ASCII path without spaces or shell metacharacters, retain the exact --aner-native-worker flag, and restrict who may replace the program or edit the service definition. Keep required runtime/provider libraries with their reviewed installation. Validate the server configuration and activate the operator approved change through that server's documented administration. The client configuration contains only the service name and enrolled SSH alias; it does not copy or deploy the binary.

Windows OpenSSH external subsystems can still traverse the server's configured default shell. This is not a universal shell bypass. This enrollment contract requires the reviewed cmd.exe launch route with raw standard handles and no profile, wrapper, redirection or pipeline. A PowerShell/custom DefaultShell route is outside the admitted setup until its binary behavior is separately validated. Aner neither guesses the shell nor changes the global DefaultShell registry. The Windows OpenSSH configuration guide describes that setting; the Windows OpenSSH launch implementation distinguishes the client subsystem request from server side command launch. The OpenSSH subsystem request provides the opaque name transport boundary.

Every native worker connection must first echo a fixed all 256 byte binary probe exactly, before parameters or tasks are sent. A transformed, truncated or reordered probe fails admission. Per node receipts report binary_transport_verified after this exchange. A compiled native worker uses binary CRT standard streams. Preserve those exact bytes through sshd and its enrolled launch path; the service must emit no banner or wrapper output on stdout. Program/runtime identity, registry, CPU admission, shape/dtype, ranges and payload digests are still checked before successful result publication. A wrong or missing subsystem, a different compiled program or transformed/truncated bytes fail visibly. Receiving a subsystem name is not attestation that a server's shell or libraries were configured correctly.

Subsystem transport is restricted to compiled ANERNATIVE/2 workers. Older interpreted/session, ANERPAR/1 and neural/regression protocols reject this enrollment rather than treating its token as an executable. Use one configured worker record per enrolled SSH target across ssh and ssh-subsystem; aliases must not be used to overbook one physical host. Linux and Windows runtime tests remain deferred at the user's request. Any macOS transport fixture is recorded separately and does not certify a remote Windows server.

The coordinator admits the worker's versioned compiled registry, program/source identity, native implementation fingerprint, ABI and policy before sending work. Work carries task IDs, bounded scalar parameters, global iteration identities, seeds and typed output descriptors through the binary protocol. It sends no source program or AST for remote evaluation. A mismatched worker rejects visibly; the coordinator does not fall back to an interpreter, a different program or an unrequested local executor.

Worker failure, malformed or mismatched responses, timeouts and incomplete contributions fail the group. The coordinator retains the failing worker identity in the diagnostic and tears down its processes. There is no durable retry/resume service or automatic failover claim.

Traceability and platform evidence

summary() retains the existing typed output accounting and adds compiled execution mode, program identity, task identity and native implementation identity. Configured process observations include each worker's public identity, PID, target, selected transport, subsystem_sha256 of the enrolled ASCII service identifier (empty for other routes), binary transport verification, completed batches and output_wire_bytes for received numerical payloads; this excludes protocol headers and is separate from parameter wire accounting. Seeds, coverage and ordered result shape remain explicit. Local active_tasks and peaks describe scheduled task state; they are not CPU utilization measurements. Each process node also reports binary_probe_roundtrip_bytes: 512, accounting for the 256 byte admission challenge and echo separately. The subsystem hash supports comparison with private enrollment while its raw service name remains in the private configuration; it is an identity, not a secret. Wire memory counters describe logical payload vectors: they exclude the separate admission probe, scalar objects/text, protocol headers, pipe buffers, allocator overhead and process RSS. Per worker maxima are reported separately; summed worker maxima need not have occurred simultaneously. Coordinator transport peaks, cumulative copy bytes and retained managed result bytes describe different scopes.

Local seconds() measures the executor work interval, excluding parameter serialization and initial/final result allocation/validation outside that interval. Cluster seconds() includes connection/admission, work, payload exchange and worker teardown, but excludes parameter serialization and complete retained result admission before worker startup. Per node compute seconds measure their executor work intervals, excluding wire encoding/transport. These fields are not interchangeable end to end timers.

The build manifest describes what was compiled. Runtime summaries describe which admitted workers and task contributions actually ran. Preserve both, with the source/generated C++, numerical agreement criterion and elapsed time boundary. A worker handshake is evidence of contract compatibility, not attestation of arbitrary remote libraries or hardware.

The local validation records identify actual runs and any skipped/deferred platforms. Linux and Windows runtime execution is deferred at the user's request, rather than reported as a pass from source or CI configuration. No speedup follows from task compilation alone. Measure compilation, startup, task dispatch, transport, useful computation and result materialization separately where possible. A same host two process test validates process isolation and contribution checks; it does not demonstrate multi host scaling or pooled memory.

C++26 readiness observes exact language/library features and optional probe results while retaining C++20 in runtime targets and generated programs. Future execution or SIMD facilities must preserve these ownership, error, floating point and placement contracts before adoption.

Recorded local measurements

On October 24, 2026, an Apple M2 Max source build used AppleClang 21, libc++ 220106, Release mode with LTO disabled, strict Float64, 64 tasks and 5,000 trajectory steps per task, with root seed 2026. Every mode used one warm up and five fresh process samples; output values and derived seeds agreed exactly. Each binary's source, runtime and generated code identities are retained in the raw measurement evidence.

These observations apply to the recorded binaries and hashes, before the final admission and metadata inspection corrections. The final source rejects incompatible execution contexts and undefined dtype inspections while preserving declared Float32 output and the measured task kernel. The final binary was not remeasured; these timings retain their recorded build scope. The ABI v3/protocol 2 binary probe and SSH subsystem route were added after these observations; no timing is attributed to those changes.

Separate compilation took between 2.30 and 2.35 seconds. Process times include startup, allocation, checks, output and shutdown; the two process case includes process launch, handshake, wire transfer and reaping. The compiled local receipt medians, 1.055 ms for one worker and 0.611 ms for two, exclude construction and other work outside the executor interval. The cluster receipt median, 20.479 ms, has the broader connection/work/transport/reaping boundary described above. These receipt values are not isolated kernel timers or substitutes for complete process observations.

This small two process workload was slower than compiled local execution. It validates real process contributions and bounded transport rather than establishing multi host scaling. No RSS, device memory, GPU or physical remote host measurement was made. The evidence retains all raw samples, ranges, median absolute deviations, exact correctness checks, workload dimensions and code/build identities. Results do not imply a universal speedup or a benefit from merely requesting additional workers.

See the Native parallel computing module reference for the shared API.