Skip to main content

Services, networking, and data

Compose deny-by-default host operations into replayable backend workflows.

Design from the capability boundary inward

Service architecture

  1. Keep request parsing, validation, routing, and response construction pure where possible.
  2. Wrap listening, accepting, reading, writing, DNS, HTTP, WebSocket, TCP, UDP, process, database, and storage work in explicit effect programs.
  3. Put bind addresses, remote origins, byte limits, query classes, process allowlists, and timeouts in policy.
  4. Record live effects and replay application logic without repeating external work.

Use the executable inbound server, service, raw sockets, and durable data examples. Agents should select the corresponding stable recipe ID from the canonical recipe-card catalog.

Data architecture

  • Content-address immutable artifacts when identity matters.
  • Use refs with compare-and-set semantics for mutable names.
  • Bound artifact, request, response, queue, and run totals.
  • Keep host paths base-relative in deterministic errors and logs.
  • Pin remote origins, authentication mode, and transport policy.
  • Treat database query class as a capability, not a string convention.

Production checklist

  • Every host op appears in the capability reference.
  • Every allowed op has least-privilege policy.
  • Timeouts hard-cancel bridge processes and reap descendants.
  • Live run and replay terminal hashes match.
  • Negative controls cover denied remote, path escape, oversized response, unavailable backend, and tampered log.
  • Package obligations include the relevant host/runtime profile.