Effects catalog

This table is the entire host effect catalog — the kernel API between a sandboxed program and the outside world. Everything above it (the any client, llm, memory, recall, history, the toolcaller loop) is guest code in programs/, built out of these calls.

Syscalls

Kind says what the effect does to the world: strict replay serves every recorded effect from the trace, and mutate effects are the ones a replay must never re-execute. Cap is the capability name the broker checks against a program's grant set before anything runs — the route-derived name for http.*, the effect's own name for everything else. The shipped run and serve attach no grant set, so every capability is permitted; a denial, when a grant set is present, is recorded as capability_denied.

In Python, programs call the facades rather than effect() directly: http.get(...) returns a Response (.status, .headers, .url, .text, .json(), .blob), now() wraps time.now, and effects.of / get / runs / stats / query wrap the trace.* views. Randomness needs no effect: random, secrets and uuid draw from a stream seeded once per run from the seed in the trace header.

Route classification

http.* is one door, but the host classifies every request by its method and route (the any server is recognized by its base URL), and that classification decides both the kind and the capability:

A program that only reads can therefore be granted data.read and nothing else, and an LLM call is a read — replay serves the recorded completion instead of spending tokens again.

# a read against the local server — classified data.read
base = effect("runtime.get", {"key": "any.base_url"})["value"]
r = http.post(f"{base}/v1/spaces/{space}/objects/query",
              json={"filter": {"any.type": "page"}, "limit": 10})
pages = r.json()["records"]

Credential injection

credential: {ref, header, prefix?, about?} — the host resolves ref and sets the header after the payload is recorded; values never reach guest memory or the trace. about ({label, hosts, help, note}) describes the credential to the human who enters it and is recorded like the rest of the payload.

A ref with nothing stored fails the call typed SecretMissing and the runtime asks for the key in the chat; a static key the destination rejects is marked for re-entry the same way.

http.get("https://api.example.com/me",
         credential={"ref": "connector.key.example", "header": "Authorization", "prefix": "Bearer "})

Why it matters. A program never holds a secret and a trace never contains one, so a run can be shared, replayed, or handed to a model for debugging without leaking credentials. See Credentials and Effects.