This project uses OpenSpec for spec-driven development. When creating proposals, refer to:
openspec/AGENTS.md- Workflow and formatopenspec/project.md- Project conventionsopenspec/specs/- Current specificationsopenspec/changes/- In-progress proposals
Before starting spec-driven development, run openspec list and openspec show [item] to review the current state.
pyproc's scope is fixed to "fast, stable invocation of Python from Go as if it were a local function, within the same host/Pod via UDS." Cross-host communication is out of scope.
v1.0 "Done" means not adding features, but "meeting the conditions for enterprise adoption":
- API/protocol stabilization
- Documentation and automation of operations, observability, security, compatibility, and release processes
- Go API: exported symbols in
pkg/pyproc(Pool, WorkerConfig, CallTyped, CodecType, Transport, etc.) - Python worker API:
expose,run_worker - Wire protocol: compatibility conditions for JSON/MessagePack/Protobuf codecs
- Config schema & env vars:
PYPROC_POOL_WORKERS,PYPROC_SOCKET_DIR, etc.
- Breaking changes bump MINOR (y)
- v1.0.0 defines the Public API
- Released versions are immutable (fixes ship as new versions)
- Go: tags
vX.Y.Z(Go Modules convention) - Python: PEP 440 compliant
X.Y.Z
Current version gap: Go v0.4.0 / pyproc-worker 0.1.0
- Cross-host communication (use gRPC/REST services instead)
- Arbitrary user-submitted Python code execution (trusted code assumption)
- GPU cluster management or distributed inference infrastructure
Achieved through "K8s + container distribution completeness," not cloud-specific solutions:
- Reference Dockerfile (Go binary + Python runtime + pyproc-worker)
- K8s manifests (emptyDir for socket write directory)
- Same-container configuration is first-class (sidecar separation is a non-goal for v1.0)
- v0.5.0: High-efficiency IPC enhancements, config schema formalization, Dockerfile stabilization
- v0.6.0: Public API outline freeze, deprecate-then-remove procedure, compatibility table publication
- v0.7.0: Observability (metrics name/label/semantics stabilization)
- v0.8.0: Security hardening (UDS permissions/HMAC auth templating, K8s emptyDir design guidelines)
- v0.9.0: API Freeze, compatibility tests (contract tests) in CI
- v1.0.0: Public API finalized, enterprise-ready release
See .ssd/ for details.
# Go tests (race detector enabled)
go test -v -race ./...
# Python tests
cd worker/python && uv run pytest -v --cov=pyproc_worker
# Go lint
golangci-lint run ./...
# Python lint + format
cd worker/python && uv run ruff check . && uv run ruff format --check .
# Benchmarks
make bench-quick
# OpenSpec
openspec list
openspec show [item]
openspec validate --strictworker/python/AGENTS.md- Python worker developmentinternal/AGENTS.md- Go internal implementationdocs/AGENTS.md- Documentationbench/AGENTS.md- Benchmarks
README.md- User-facing overviewCONTRIBUTING.md- Contribution guidedocs/design.md- Design decisionsdocs/security.md- Security threat modeldocs/ops.md- Operations guide
- Go errors must be wrapped with
fmt.Errorf("context: %w", err) - Python functions must have type hints and Google-style docstrings
- All exported Go types/functions must have doc comments
- Channel operations must use
select + context.Done()for cancellation - UDS socket permissions must be 0660
- Do not log PII or secrets
- Do not weaken tests, lints, or CI gates to pass checks
- Security-related files (
docs/security.md,internal/protocol/,.claude/rules/security.md) require explicit reviewer approval - Performance-sensitive changes in IPC hot paths must include benchmark results