Concepts

Job

A request to run a definition, identified by its hash, with arguments, a policy and an envelope.

Policy

Which abilities the job may use, and which handler answers each one. An ability with no handler cannot be performed.

Envelope

The resource limits of a run. A run that exceeds them stops and says so.

Runner

A process that accepts jobs, enforces the policy and envelope, and returns a result with a usage report.

Grant and connection

A grant lets a job use something you own for a while; a connection lends access to an outside service without handing over the secret.

These are the terms of the design in the repository (docs/runner-contracts.md); they may change before anything ships.